US20110252478A1 - System and method of analyzing web content - Google Patents
System and method of analyzing web content Download PDFInfo
- Publication number
- US20110252478A1 US20110252478A1 US13/164,688 US201113164688A US2011252478A1 US 20110252478 A1 US20110252478 A1 US 20110252478A1 US 201113164688 A US201113164688 A US 201113164688A US 2011252478 A1 US2011252478 A1 US 2011252478A1
- Authority
- US
- United States
- Prior art keywords
- url
- content
- data
- module
- urls
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/285—Clustering or classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
Definitions
- This application relates to data and application security.
- this application discloses systems methods of collecting and mining data to determine whether the data includes malicious content.
- What is needed is a system and method that allows for the detection of malicious web content without compromising user functionality. Further, what is needed is a system that can detect executable content and quickly identify and categorize its behavior, and provide protection from the malicious content to a high volume of client computers with minimum delay.
- a computer-implemented method of identifying inappropriate content in web content includes receiving a request for a web content.
- the requested web content is compared to data in a database. If the requested content is not in the database, it is sent to a collection module which collects data related to the requested content. Based on the collected data, a candidate status for the URL is determined.
- a system for identifying candidate URLs from a set of uncategorized URLs may include a URL database configured to store the uncategorized URLs and a collection system configured to collect information about the uncategorized URLs including data-related to the uncategorized URLs.
- the collection system may include a data mining module configured to identify uncategorized URLs having a characteristic indicative of targeted content.
- a computer-implemented method of collecting data about URLs includes providing a data mining module with a configuration plug-in.
- the data mining module may have a plurality of dispatchers configured to operate independently of each other.
- the data mining module receives URL data for analysis, and separates the URL data into work units of URL strings.
- the method further provides for determining whether one of the plurality of dispatchers is available for receiving a work unit, and sending the URL to one of the dispatchers if it is available.
- a system for collecting data about URLs may include a database for storing information about URLs.
- the system may also include a pool of dispatchers which include asynchronous system processes each configured to receive URL data input and perform actions on the data.
- the system may also include a driver module configured to monitor the pool of dispatchers for available dispatchers, and send part of the URL data input to the available dispatchers.
- a system for identifying candidate URLs from a set of uncategorized URLs include means for storing the uncategorized URLs, means for collecting information related to the uncategorized URLs, and means for identifying the uncategorized URLs having a characteristic indicative of targeted content.
- FIG. 1 is a block diagram of various components of a system in accordance with aspects of the invention.
- FIG. 2 is a block diagram of a workstation module from FIG. 1 .
- FIG. 3 is a block diagram of a gateway server module from FIG. 1 .
- FIG. 4 is an example of a logging database.
- FIG. 5 is an example of a URL Access Policy database table.
- FIGS. 6A and 6B are examples of categorized and uncategorized URLs, respectively.
- FIG. 7 is a block diagram of a database management module from FIG. 1 .
- FIG. 8 is a block diagram of a collection system from FIG. 7 .
- FIG. 9 is a block diagram of a collection module from FIG. 8 .
- FIG. 10 shows a honey client system according to some aspects of the invention.
- FIG. 11 is an example of URL-related data collected by the collection module from FIG. 9 .
- FIG. 12 is a flowchart describing how URLs may be handled in the gateway server module in one embodiment.
- FIG. 13 is a flowchart describing how URLs may be handled by the gateway server module in conjunction with the policy module according to certain embodiments.
- FIG. 14 is a flowchart describing the how the collection system may handle a URL within the gateway server module.
- FIG. 15 is a flowchart describing the how the collection system may handle a URL within the database management module.
- FIG. 16 is a flowchart describing how the honey client control server may be used to collect URL data.
- FIG. 17 is a flowchart describing how data collected by the collection system may be further supplemented to allow for detailed analysis.
- FIG. 18 is a block diagram of a data mining system.
- potentially executable web content generally refers to any type of content that includes instructions that are executed by a web browser or web client computer.
- Potentially executable web content may include, for example, applets, executable code embedded in HTML or other hypertext documents (including script languages such as JavaScript or VBScript), executable code embedded in other documents, such as Microsoft Word macros, or stylesheets.
- Potentially executable web content may also refer to documents that execute code in another location such as another web page, another computer, or on the web browser computer itself.
- a HTML web page that includes an “OBJECT” element may generally be considered potentially executable web content regardless of the location of the executable components.
- Malicious content may refer to content that is not executable but which is calculated to exploit a vulnerability on a client computer.
- potentially executable web content may also be malicious content.
- image files have been used to exploit vulnerabilities in certain operating systems when those images are processed for display.
- malicious web content may also refer to interactive content such as “phishing” schemes in which a HTML form or other web content is designed to appear to be provided by another, typically trusted, web site such as a bank, in order to deceive the user into providing credentials or other sensitive information to an unauthorized party.
- FIG. 1 provides a top level illustration of an exemplary system.
- the system includes a network 110 .
- the network 110 may be a local area network, a wide area network, or some other type of network.
- the network 110 may include one or more workstations 116 .
- the workstations 116 may be various types of client computers that are attached to the network.
- the client computers 116 may be desktop computers, notebook computers, handheld computers or the like.
- the client computers may also be loaded with operating systems that allow them to utilize the network through various software modules such as web browsers, e-mail programs, or the like.
- Each of the workstations 116 may be in electrical communication with a gateway server module 120 .
- the gateway server module may reside at the edge of the network 110 so that traffic sent to and from the Internet 112 may pass through it on its way into or out of the network 110 .
- the gateway server module 120 may take the form of a software module that is installed on a server that stands as a gateway to a wider area network 112 than the network 110 to which the workstations 116 are directly attached.
- a database management module 114 Also connected to the Internet 112 is a database management module 114 .
- the database management module also may be a software module (or one or more hardware appliances) which resides on one or more computing devices.
- the database management module 114 may reside on a machine that includes some sort of network connecting hardware, such as a network interface card, which allows the database management module 114 to send and receive data and information to and from the Internet 112 .
- the workstation 116 may include a workstation module 130 .
- the workstation module 130 may take the form of software installed to run on the operating system of the workstation 116 .
- the workstation module 130 could be an application running on another machine that is launched remotely by the workstation 116 .
- the workstation module 130 may include various components.
- the workstation module may include an inventory of a local active content module 132 which records all web content stored on the workstation 116 .
- the local content inventory module 132 may periodically inventory all local content.
- the inventoried data may be uploaded to the gateway server module 120 for comparison to a categorized URL/content database 146 (discussed in further detail below).
- the local content inventory module 132 may determine whether new content is being introduced to the workstation 116 by comparison to the inventoried local content contained therein.
- the workstation module also may include an upload/download module 134 and a URL request module 136 .
- the upload/download module 134 may be used to send and receive data from the network 110 , through the gateway server module 120 and to the Internet 112 .
- the URL request module 136 receives a URL input from either a user or some system process, and may send a request via the gateway server module 120 to retrieve the file and/or content associated with that URL.
- the functions of each of the upload/download module 134 and the URL request module 136 may be performed by a software applications such as web browsers, with Internet Explorer®, Mozilla Firefox, Opera, Safari, being examples of browsing software well-known in the art.
- the functions of the modules may be divided among different software applications.
- an FTP application may perform the functions of the upload/download module 134 , while a web browser my perform URL requests.
- Other types of software may also perform the functions of the upload/download module 134 .
- these types of software are generally not desirable on a workstation, software such as Spyware, or Trojan Horses may make requests to send and receive data from the Internet.
- the workstation module 130 may be in communication with the gateway server module 120 .
- the gateway server module 120 may be used to analyze incoming and outgoing web traffic and to make various determinations about the impact the traffic may have on the workstations 116 .
- FIG. 3 an example of the gateway server module 120 is provided.
- the gateway server module 120 is in two way communication with the workstation 116 . It may receive file uploads and downloads and URL requests from the workstation module 130 .
- the gateway server module 120 is also in two way communication with the Internet 112 . Thus, requests originating within the workstations 116 of the network 110 may be required to pass through the gateway server module 120 as they proceed to the Internet.
- the gateway server module 120 may be integrated with some firewall hardware or software that protects the network 110 from unauthorized intrusions from the Internet 112 .
- the gateway server module 120 may be a standalone hardware appliance or even a software module installed on a separate gateway server residing at the network gateway to the Internet 112 .
- the gateway server module 120 may receive URL requests and upload/download data from the workstation 116 by way of the workstation module 130 .
- the gateway server module 120 may include various components that perform various functions based on the data received.
- the URL database 146 may be used to store information about URLs including data that is associated with the URLs.
- the categorized URL database 146 may be a relational database, or it may be stored in some other form such as a flat file, an object-oriented database, and may be accessed via an application programming interface (API), or some database management software (DBMS).
- API application programming interface
- DBMS database management software
- the URL database 146 may generally be used to help determine whether URL requests sent by the URL request module 136 will be permitted to be completed.
- the URLs stored in the URL database 146 are categorized.
- the gateway server module 120 may also include a policy module 142 .
- the policy module 142 may be used to implement network policies regarding how certain content will be handled by the gateway server module 120 or by a firewall or some other security software installed within the network 110 .
- the policy module 142 may be configured to provide the system guidance on how to handle URL requests for categorized URLs.
- the gateway server module 120 may be configured to disallow URL requests that are categorized as being “Malicious” or “Spyware.”
- the policy module 142 may be used to determine how to handle URL requests that have not been categorized.
- the system may be configured to block all requests for URLs that are not in the categorized URL database 146 .
- the policy module 142 may also be configured to allow certain requests of uncategorized URLs based on the user making the request or the time at which the request is made. This allows the system to avoid having a one-size-fits-all configuration when such as configuration would not meet the business needs of the organization running the gateway server module 120 .
- the gateway server module 120 may include a collection module 140 .
- the collection module 140 may be a software program, routine, or process that is used to collect data about URLs.
- the collection module 140 may be configured to visit the URL and download the page data to the gateway server module 120 for analysis by components of the gateway server module 120 .
- the downloaded data may also be sent via the Internet 112 for delivery to the database management module 114 (as will be discussed in further detail below).
- the gateway server module 120 may also include a logging database 144 .
- the logging database 144 may perform various functions. For example, it may store records of certain types of occurrences within the network 110 .
- the logging database 144 may be configured to record each event in which an uncategorized URL is requested by a workstation 116 .
- the logging database 144 may also be configured to record the frequency with which a particular uncategorized URL is requested. This information may be useful in determining whether an uncategorized URL should be of particular importance or priority and should be categorized by the database management module 114 ahead of earlier received data.
- uncategorized URLs may be stored separately in an uncategorized URL database 147 .
- some spyware may be written to request data from a particular URL. If many workstations 116 within the network 110 are infected with the spyware, repeated requests to a particular URL may provide an indication that some anomaly is present within the network.
- the logging database may also be configured to record requests of categorized URL data. In some embodiments, categorizing requests of categorized URLs may be helpful in determining whether a particular URL has been mischaracterized.
- the logging database 144 includes four columns of data.
- the first column, “No. Page Requests” 152 is indicative of the number of times a particular URL has been requested by users within the network 110 .
- the second column “URL” 154 records the particular URL string that is being logged in the logging database 144 .
- the database may first be searched to determine whether the URL string is already in it. If not, then the URL string may be added to the database.
- the collection module 140 may be configured to visit the requested URL and gather data about the URL.
- the collection module 140 may retrieve the page source of the requested URL and scan it for certain keywords that may indicate a type of content. For example, if the page source includes “javascript://” then the page may be identified as having JavaScript. While such content is not inherently dangerous, a web page with JavaScript may have a greater chance of including malicious content designed to exploit how a browser application handles JavaScript function calls. In some embodiments, this data may be stored in the logging database 144 in JavaScript column 155 . The logging database may also receive similar information from pages that include Active-X content and store that content within Active X column 156 . In other embodiments, other types of content may be detected and stored for java applets, VBScript, and the like.
- the gateway server module 120 may further include an administrative interface module 148 or “admin module.”
- the admin module 148 may be used to allow network administrators or other technical personnel within an organization to configure various features of the gateway server module 120 .
- the admin module 148 allows the network administrator or some other network management-type to configure the policy module 142 .
- the URL access policy database 158 may be used by the policy module 142 to implement policies for accessing web-based content by workstations 116 within the network 110 .
- the URL access policy database 158 includes a table with four columns. The first column is a user column 160 .
- the “User” column 160 includes data about the users that are subject the policy defined in a given row of the table.
- the next column, “Category” 162 lists the category of content to which the policy defined by that row is applicable.
- the third column, “Always Block” 164 represents the behavior or policy that is implemented by the system when the user and category 166 of requested content match the user and category as defined in that particular row.
- the “Always Block” field may be a Boolean-type field in which the data may be set to either true or false.
- the policy module 142 is configured to “always block” requests for “malicious content” by user “asmith.”
- the policy module may also be configured to implement policies based on different times.
- the fourth column “Allowed Times” 166 provides this functionality.
- the second row of data provides an example of how time policies are implemented.
- the user 164 is set to “bnguyen” and the category 162 is “gambling.”
- the policy is not configured to “always block” gambling content for “bnguyen,” as indicated by the field being left blank.
- the time during which these URL requests are permitted is limited to from 6PM to 8AM.
- adopting these types of policies allows network administrators to provide a certain degree of flexibility to workstations and users, but to do so in a way that network traffic is not compromised during typical working hours.
- FIGS. 6A and 6B provide illustrations of how the categorized URL database 146 may store categorized data.
- the categorized URLs may be stored in a two-column database table such as the one shown in FIG. 6A .
- the table may include a URL column 172 which may simply store the URL string that has been characterized.
- the Category column 174 may store data about the how that URL has been characterized by database module 114 (as will be described in detail below).
- the URL field may be indexed so that it may be more quickly searched in real time. Because the list of categorized URLs may reached well into the millions of URLs, a fast access routine is beneficial.
- the table of uncategorized URLs 147 is provided (described earlier in connection with FIG. 3 ). This table may be populated by URL requests from the workstation 116 which request URLs that are not present in the categorized URL table 146 .
- the gateway server module 120 may be configured to query the categorized URL database 146 to determine whether a requested URL should be blocked. If the requested URL is in the categorized database 146 the policy module may determine whether to allow the request to proceed to the internet 112 .
- the requested URL is not found in the categorized URL database, however, it may be added to the list of uncategorized URLs 176 so that it may be sent to the database management module 114 via the Internet 112 and later analyzed and categorized and downloaded into the database of categorized URLs 146 .
- FIG. 7 is an illustration of various components that may be included in the database management module 114 .
- the database management module 114 may be located remotely (accessible via Internet 112 ) from the network 110 and its associated workstations 116 .
- the database management module may take the form of one or many different hardware and software components such as a server bank that runs hundreds of servers simultaneously to achieve improved performance.
- the database management module 114 may include an upload/download module 178 .
- the upload/download module 178 may be a software or hardware component that allows the database management module 114 to send and receive data from the Internet 112 to any number of locations.
- the upload/download module is configured to send newly categorized URLs to gateway server modules 120 on the Internet 112 for addition to their local URL databases 146 .
- the database management module 114 may also include a URL/content database 180 .
- the URL/content database 180 may take the form of a data warehouse which stores URL strings and information about URLs that have been collected by the collection system 182 .
- the URL/content database 180 may be a relational database that is indexed to provide quick and effective searches for data.
- the URL database may be a data warehousing application which spans numerous physical hardware components and storage media.
- the URL database may include data such as URL strings, the content associated with those strings, information about how the content was gathered (e.g., by a honey client, by a customer submission, etc.), and possibly the date in which the URL was written into the URL/content database 180 .
- the database management module 114 may further include a training system 184 .
- the training system 184 may be a software/hardware module which is used to define properties and definitions that may be used to categorize web-based content.
- the database management module 114 may further provide a scoring/classification system 186 which utilizes the definitions and properties created by the training system 184 to provide a score or classification (e.g., a categorization) to web content so that the categorization may be delivered via the upload/download module 178 to gateway server modules 120 .
- a score or classification e.g., a categorization
- the collection system 182 may include a collection module 190 which is coupled (either directly or indirectly) to a data mining module 192 .
- the collection module 190 may be used by the database management module 114 to collect data for the URL/content database 180 about URLs that have not been categorized. The collection module may also be used to collect URLs for additional analysis by other system components.
- the collection module 190 may be associated with one or more collection sources 194 from which it may collect data about URLs. Collection sources may take various forms. In some embodiments, the collection sources 194 may include active and passive honeypots and honey clients, data analysis of logging databases 144 stored on gateway server module 120 to identify applications, URLs and protocols for collection.
- the collection sources may also be webcrawling applications that search the Internet 112 for particular keywords or search phrases within page content.
- the collection sources 194 may also include URLs and IP addresses data mined from a DNS database to identify domains that are associated with known malicious IP addresses.
- URLs for categorization may be collected by receiving malicious code and malicious URL samples from other organizations who share this information.
- URLs may be collected via e-mail modules configured to receive tips from the public at large, much in the way that criminals are identified through criminal tip hotlines.
- the collection module 190 may include various subcomponents that allow it to effectively utilize each of the collection sources described above.
- the collection module 190 may include a search phrase data module 197 and a expression data module 198 .
- the search phrase data module 197 collects and provides search phrases that may be relevant to identifying inappropriate content.
- the expression data module 198 may include various types of expressions such as regular expressions, operands, or some other expression.
- the search phrase data module 197 and the expression data module 198 each may include updatable record sets that may be used to define the search parameters for the web crawling collection source 194 .
- the collection module 190 may also include a priority module 200 .
- the priority module 200 may take the form of a software process running within the collection system 182 , or it may run as a separate process.
- the priority module may be used to prioritize the data collected by the collection module in order to have more potentially dangerous or suspect URLs (or data) receive close inspection prior to the likely harmless URLs.
- the priority module 200 may assign priority based on the collection source 194 from which the URL is received. For example, if a URL is received from a customer report, it may be designated with a higher priority. Similarly, if the URL is received from a web crawler accessing a domain or IP address or subnet known to host malicious content in the past, the URL may receive a high priority.
- the collection module 190 may also include a data selection module 202 which may work with the priority module 200 to determine whether identified URLs should be tagged as candidate URLs for categorization.
- the data selection URL may provide a user interface for receiving search parameters to further refine the prioritized data by searching for data based on priority and content.
- the collection module may also include a data download module 204 .
- the data download module 204 may be configured to identify URLs to visit and to download data and content from the visited URLs.
- the data download module may work in conjunction with various subsystems in the collection module to retrieve data for the URL/content database 180 .
- One such subsystem is the webcrawler module 206 .
- the webcrawler module 206 may be a software application configured to access websites on the Internet 112 by accessing web pages and following hyperlinks that are included in those pages.
- the webcrawler module 206 may be configured with several concurrent processes that allow the module to simultaneously crawl many websites and report the visited URLs back to the URL/content database 180 as will be discussed in further detail below.
- the collection module 190 may also include a honey client module 208 .
- the honey client module 208 is a software process configured to mimic the behavior of a web browser to visit websites in such a manner that is inviting to malicious code stored within the visited pages.
- the honey client module 208 may visit the web sites and track the behavior of the websites and download the content back to the URL/content database 180 for further analysis.
- the download module 204 may also include a third party supplier module 212 which is configured to receive URLs and associated content from third parties.
- the third party module 212 may be configured to provide a website which may be accessed by the general public.
- the module may be configured to receive an input URL string which may then be entered into the URL/content database 180 .
- the third party module may also be configured to receive e-mails from private or public mailing lists, and to identify any URL data embedded within the e-mails for storage in the URL/content database 180 .
- the download module may also include a gateway server access module 210 .
- the gateway server access module is a software component or program that may be configured to regularly access the logging database 144 on the gateway server module 120 to download/upload all of the newly uncategorized web content identified by the logging database 144 .
- the collection system may also include a data mining module 192 .
- the data mining module 192 may be used to obtain additional data about URLs stored in the URL/content database 180 .
- the information supplied by the collection sources 194 to the collection module 190 and URL/content database 180 is limited to nothing more than a URL string.
- more data may be necessary. For example, the actual page content may need to be examined in order to determine whether there is dangerous content embedded within the URL.
- the data mining module 192 is used to collect this additional necessary data about the URLs, and will be discussed in further detail below.
- FIG. 10 provides a more detailed view of a honey client system 208 .
- the honey client system 208 includes control servers 220 .
- the control servers 220 are used to control a plurality of honey miners 222 which are configured to visit web sites and mimic human browser behavior in an attempt to detect malicious code on the websites.
- the honey miners 222 may be passive honey miners or active honey miners.
- a passive honey miner is similar to a web crawler as described above. However, unlike the web crawler above which merely visits the website and reports the URL links available from that site, the passive honey miners may be configured to download the page content and return it to the control servers 220 for insertion into the URL/content database 180 or into some other database.
- the honey miners 222 may be software modules on a single machine, or alternately, they may be implemented each on a separate computing device.
- each control server may control 16 passive honey miners 222 .
- the control servers 220 may extract or receive URLs from the URL/content database 180 which need additional information in order to be fully analyzed or categorized.
- the control servers 220 provide the URLs to the miners which in turn review the URLs and store the collected data.
- a passive miner 222 When a passive miner 222 is finished with a particular URL, it may request another URL from its control server 222 .
- the miners 222 may be configured to follow links on the URL content so that in addition to visiting URLs specified by the control server 220 , the miners may visit content that it linked to those URLs.
- the miners 222 may be configured to mine to a specified depth with respect to each original URL. For example, the miners 222 may be configured to mine down through four layers of web content before requesting new URL data from the control server 220 .
- control servers 220 may be configured to control active honey miners 222 .
- the active honey miners 222 may be configured to visit URLs and run or execute the content identified on the sites.
- the active honey miners 222 include web browsing software that is configured to visit websites and access content on the websites via the browser software.
- the control server 220 (or the honey miners themselves 222 ) may be configured to monitor the characteristics of the honey miners 222 as they execute the content on the websites they visit. In one embodiment, the control server 220 will record the URLs that are visited by the honey miners as a result of executing an application or content on the websites visited.
- active honey miners 222 may provide a way to more accurately track system behavior and discover previously unidentified exploits. Because the active honey miners expose themselves to the dangers of executable content, in some embodiments, the active honey miners 222 may be located within a sandbox environment, which provides a tightly-controlled set of resources for guest programs to run in, in order to protect the other computers from damage that could be inflicted by malicious content.
- the sandbox may take the form of a virtual machine emulating an operating system. In other embodiments, the sandbox may take the form of actual systems that are isolated from the network. Anomalous behavior may be detected by tracking in real-time, changes made to the file system on the sandbox machine.
- the code executed by the active honey miners 222 may cause the machine on which they are running to become inoperable due to malicious code embedded in the webpage content.
- the control server may control a replacement miner which may step in to complete the work of a honey miner 222 which is damaged during the mining process.
- the collected data may also include a URL 232 as indicated by the second column in FIG.
- the URL 232 may often include various pages from the same web domains, as the miners may have been configured to crawl through the links in the websites.
- the collected data may also include the page content 234 for a particular URL. Because the content of a URL may be in the form of graphics, text, applications and/or other content, in some embodiments, the database storing this URL data may be configured to store the page content as a binary large object (blob) or application objects in the data record. However, as some web pages contain text exclusively, the page content 234 may be stored as text as well.
- the collection routine may be configured to determine whether the URL contains executable content. In these instances, the resultant data set of collected data may include an indication of whether the URL has executable content 236 within its page code. This information may be later used in selecting data from the URL/content database 180 has candidate data for analysis.
- the gateway server module 120 may be configured to control access to certain URLs based on data stored in the categorized URL database 146 .
- FIG. 12 is a flowchart describing an embodiment in which the gateway server module handles a request from a workstation 116 .
- the workstation 116 requests a URL from the Internet 112 .
- This request is intercepted at the Internet gateway and forwarded to the gateway server module 120 at block 1202 .
- the categorized URL database 146 is queried to determine if the requested URL is stored in the database 146 . If the requested URL is found as a record in the database, the process moves on to block 1206 , where it analyzes the URL record to determine whether the category of the URL is one that should be blocked for the workstation user. If the category is blocked, the process skips to block 1212 and the request is blocked. If the category is not blocked, however, the request is allowed at block 1208 .
- the system proceeds to block 1210 .
- the system determines how to handle the uncategorized content. In some embodiments, the system may utilize the policy module 142 to make this determination. If the gateway server module 120 is configured to block requests for uncategorized content, the process moves to block 1212 , and the request is blocked. If, on the other hand, the module is configured to allow these types of uncategorized requests, the process moves to block 1208 , where the request is allowed to proceed to the Internet 112 .
- the request of URL data may result in new records being added to the logging database 144 . These records may be later transferred to the database management module 114 for further analysis.
- FIG. 13 another flowchart describing a process by which the gateway server module may handle a URL request is provided.
- the gateway server module 120 receives a request for a URL. As noted above, this request may come from a workstation 116 .
- the URL is then compared against the categorized URL database 146 , and the system determines at block 1304 whether the requested URL is in the categorized URL database.
- the process skips to block 1308 . If the requested URL is not found in the categorized URL database 146 , however, the process moves to block 1306 where the URL is inserted into the uncategorized URL database 147 . (In some embodiments, the logging database 144 and the uncategorized URL 147 database may be the same database.) After inserting the URL into the database, the method proceeds to block 1308 .
- the policy database is checked for instructions on how to handle the received URL. Once the policy module 142 has been checked, the logging database 144 is updated to record that the URL has been requested at block 1310 .
- the process moves to block 1314 and the URL request is sent to the Internet 112 . If, however, the policy database does not allow the request, the process skips to block 1316 and the request is blocked.
- the gateway server module 120 may perform collection to lessen the burden on the collecting system 182 of the database management module 114 .
- FIG. 14 provides an example of a system in which the gateway server collection module 140 is used to collect data about an uncategorized URL.
- the gateway server module receives a request for a URL.
- the requested URL is compared against the categorized URL database. If the system determines that the requested URL is in the URL database at block 1404 , the process moves to block 1410 , where the request is either forwarded to the Internet 112 or blocked depending on how the URL is categorized.
- the process moves to block 1406 where the URL is sent to the gateway collection module 140 .
- the collection module 140 collects URL data about the requested URL. In some embodiments, this data may be stored in the uncategorized URL database 147 . Alternatively, this data may simply be forwarded to the database management module 114 via the Internet 112 . Once the data has been collected and stored, the process moves to block 1410 where the URL request is either allowed or blocked based on the policies indicated in the policy module 142 .
- uncategorized URL data may be sent from the gateway server module 120 to the database management module 114 for further analysis so that the URL may be categorized and added to the categorized URL database 146 .
- the volume of uncategorized data is so large at times, it may not be possible to categorized all of the received data without compromising accuracy.
- FIG. 15 provides an example of a method for identifying candidate URLs for further analysis.
- the method starts with a URL being received into the collection system 182 of the database module 114 .
- the URL or application is preprocessed to determine whether it carries a known malicious data element or data signature.
- the process skips to block 1514 where the URL is tagged as a candidate URL and sent to the training system 184 for further analysis. If the initial analysis of the URL in block 1504 does not reveal a malicious element, the process moves to block 1506 , where the URL is added to a database of potential candidate URLs.
- the data mining module 192 is configured to select URLs from sources 194 (of which the database of potential candidate URLs is one) based on preconfigured conditions such as attack strings, virus signatures, and the like.
- the data set including all of the data sources 194 is then sent to the data mining module 192 at block 1510 , where each URL is analyzed by the data mining module 192 at block 1512 . If the URL satisfies the defined preconfigured conditions, the process moves to bock 1514 where the URL is tagged as a candidate URL and sent on to the scoring/classification system 186 for additional analysis.
- the method proceeds to block 1516 and the URL is not tagged as a candidate.
- this embodiment is described in the context of URL candidate classification, one of skill in the art will readily appreciate that applications may be similarly analyzed and tagged as candidates using the process described above.
- the system may utilize the honey client system 208 in conjunction with the data mining system 192 to collect URLs to be added to the candidate URL list for classification.
- FIG. 16 illustrates an example of a process for collecting this data.
- the honey client control server 220 is launched.
- the control server 220 launches one or more honey miners 222 at block 1602 .
- the honey miners 222 visit the next URL provided to them by the control servers 220 and parse the page source of that URL to determine if there is active content in the URL at block 1606 . If no active content is found in the page, the process skips to block 1610 . If however, active content is found the process moves to block 1608 where the URL is added to the candidate URL list.
- the miner 222 determines whether the current URL contains hyperlinks or forms. If no hyperlinks or forms are found, the process loops back to block 1604 where the miner receives another URL from the control server 222 for analysis. If, however, the URL contains hyperlinks or forms, the method proceeds to block 1612 where it then determines whether the URL includes hidden links or forms. Because many malicious websites wish to avoid detection by mining software such as the honey clients systems 208 , they include hidden hyperlinks that are not visible when browsed by a human. Thus, the website can detect a miner by hiding these links as “bait.” One technique used to hide the links is to make them the same color as the background of the web page. If the miner follows the links, then the website is alerted to its presence.
- the miner is configured to detect these hidden links. If no hidden links are present, the process skips to block 1618 , and the miner continues by following the non-hidden links that are in the URL content. If however, any hidden links are present, at block 1614 , the URL and its hidden links are added to the classification list and passed over at block 1616 . Once the hidden links have been processed (i.e., added to the classification list), the method then proceeds to block 1618 where the non-hidden links are followed.
- URL data is added to the URL/content database 180 without all of the necessary data for full analysis by the scoring/classification system 186 .
- the only data received about a URL from a collection source 194 is the URL string itself. Thus, it may become necessary to collect additional data about URLs in order properly analyze them.
- FIG. 17 a process is shown describing how the system may handle candidate URLs according to one embodiment.
- data from a collection source is added to the URL/content database 180 .
- the URL/content database 180 may be a data warehouse.
- the system looks at the URL data and determines whether there is missing content that is necessary for analysis.
- the system determines that more data is needed and sends the URL to the data mining module for supplementation at block 1704 .
- the data mining module then may take the data received and collect additional data. If no content is missing, the URL is immediately sent to the scoring/classification module 186 for further analysis at block 1706 .
- the data mining module 192 may be used to address these issues by collecting large volumes of relevant data utilize system resources effectively and efficiently.
- FIG. 18 a more detailed block diagram of the data mining system 192 is provided.
- the data mining system 192 may take the form of a software module that runs a plurality of asynchronous processes to achieve maximum efficiency and output.
- the data mining system 192 may include a plug-in module 242 which receives configuration parameters which provide instruction on how inputted data should be handled.
- the instructions received by the plug-in module may take the form of an HTTP protocol plug-in that provide parameters for the data mining system 192 to receive URL data and analyze and supplement the data based on various HTTP-related instructions implemented by the data mining system on the URL data.
- the plug-in may be geared toward mining some other protocol such as FTP, NNTP, or some other data form.
- the data mining system 192 may also include a pool 246 of dispatchers 248 .
- the dispatchers 248 are individual asynchronous processing entities that receive task assignments based on the data input (for analysis) into the data mining system and the configuration data received by the plug-in module 242 .
- the pool 246 is a collection of the dispatchers that is controlled by a driver 244 .
- the driver 244 is a managing mechanism for the pool.
- the driver 244 may be configured to monitor the activity of the dispatchers 248 in the pool 246 to determine when to send additional data into the pool 246 for mining and analysis. In one embodiment, the driver may be configured to send new data units into the pool 246 whenever any dispatchers 248 are idle.
- the driver 244 may be utilized as a control server for managing honey client miners 222 as described above in connection with FIG. 10 .
- the pool 246 may deliver the data unit to the idle dispatcher 248 .
- the dispatcher 248 reads the plug-in configuration and performs actions in accordance with plug-in 242 .
- the plug-in module may receive an HTTP plug-in.
- the HTTP plug-in may be configured to receive input data in the form of URL strings about which the data mining system 192 will obtain addition information such as the page content for the URL, HTTP messages returned by the URL when accessed (such as “ 4 xx—file not found” or “ 5 xx—server error”).
- the plug-in may further specify a webcrawling mode in which the dispatches, in addition to collecting page content, also add URL links within the URL content to the URL data set to be analyzed.
- database refers to any collection of stored data stored on a medium accessible by a computer.
- a database may refer to flat data files or to a structured data file.
- the various illustrative databases described in connection with the embodiments disclosed herein may be implemented as databases that combine aspects of the various illustrative databases or the illustrative databases may be divided into multiple databases.
- one or more of the various illustrative databases may be embodied as tables in one or more relational databases.
- Embodiments may be implemented in relational databases, including SQL databases, object oriented databases, object-relational databases, flat files, or any other suitable data storage system.
- DSP digital signal processor
- ASIC application specific integrated circuit
- FPGA field programmable gate array
- a general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine.
- a processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
- a software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
- An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
- the storage medium may be integral to the processor.
- the processor and the storage medium may reside in an ASIC.
- the ASIC may reside in a user terminal.
- the processor and the storage medium may reside as discrete components in a user terminal.
Abstract
Description
- This Application is a continuation of U.S. patent application Ser. No. 11/484,240 filed Jul. 10, 2006 which is related to U.S. patent application Ser. No. 11/484,335, filed on Jul. 10, 2006, both of which are hereby incorporated by reference in their entirety.
- 1. Field of the Invention
- This application relates to data and application security. In particular, this application discloses systems methods of collecting and mining data to determine whether the data includes malicious content.
- 2. Description of the Related Technology
- Traditionally, computer viruses and other malicious content were most often provided to client computers by insertion of an infected diskette or some other physical media into the computer. As the use of e-mail and the Internet increased, e-mail attachments became a prevalent method for distributing virus code to computers. To infect the computer with these types of viruses having malicious content, some affirmative action was typically required by the user such as opening an infected file attachment or downloading an infected file from a web site and launching it on their computer. Over time, antivirus software makers developed increasingly effective programs designed to scan files and disinfect them before they had the opportunity to infect client computers. Thus, computer hackers were forced to create more clever and innovative ways to infect computers with their malicious code.
- In today's increasingly-networked digital world, distributed applications are being developed to provide more and more functionality to users in an open, collaborative networking environment. While these applications are more powerful and sophisticated, their increased functionality requires that network servers interact with client computers in a more integrated manner. For example, where previous web applications primarily served HTML content to client browsers and received data back from the client via HTTP post commands, many new web applications are configured to send various forms of content to the client computer which cause applications to be launched within the enhanced features of newer web browsers. For example, many web-based applications now utilize Active-X controls which must be downloaded to the client computer so they may be effectively utilized. Java applets, VBScript and JavaScript commands also have the capability of modifying client computer files in certain instances.
- The convenience that has arrived with these increases in functionality has not come without cost. Newer web applications and content are significantly more powerful than previous application environments. As a result, they also provide opportunities for malicious code to be downloaded to client computers. In addition, as the complexity of the operating system and web browsing applications increase, it becomes more difficult to identify security vulnerabilities which may allow hackers to transfer malicious code to client computers. Although browser and operating system vendors generally issue software updates to remedy these vulnerabilities, many users have not configured their computers to download these updates. Thus, hackers have begun to write malicious code and applications which utilize these vulnerabilities to download themselves to users' machines without relying on any particular activity of the user such as launching an infected file. One example of such an attack is the use of malicious code embedded into an active content object on a website. If the malicious code has been configured to exploit a vulnerability in the web browser, a user may be infected or harmed by the malicious code as a result of a mere visit to that page, as the content in the page will be executed on the user's computer.
- An attempt to address the problem of malicious code embedded in content is to utilize heightened security settings on the web browser. However, in many corporate environments, intranet or extranet applications are configured to send executable content to client computers. Setting browser settings to a high security level tends to impede or obstruct the effective use of these types of “safe” applications. Another attempt to address the issue is to block all executable content using a network firewall application. This brute force approach also is ineffective in many environments, because selective access to certain types of content is necessary for software to correctly function.
- What is needed is a system and method that allows for the detection of malicious web content without compromising user functionality. Further, what is needed is a system that can detect executable content and quickly identify and categorize its behavior, and provide protection from the malicious content to a high volume of client computers with minimum delay.
- The system, method, and devices of the present invention each have several aspects, no single one of which is solely responsible for its desirable attributes. Without limiting the scope of this invention, several of its features will now be discussed briefly.
- In one embodiment, a computer-implemented method of identifying inappropriate content in web content is provided. The method includes receiving a request for a web content. The requested web content is compared to data in a database. If the requested content is not in the database, it is sent to a collection module which collects data related to the requested content. Based on the collected data, a candidate status for the URL is determined.
- In another embodiment, a system for identifying candidate URLs from a set of uncategorized URLs is provided. The system may include a URL database configured to store the uncategorized URLs and a collection system configured to collect information about the uncategorized URLs including data-related to the uncategorized URLs. The collection system may include a data mining module configured to identify uncategorized URLs having a characteristic indicative of targeted content.
- In yet another embodiment, a computer-implemented method of collecting data about URLs is provided. The method includes providing a data mining module with a configuration plug-in. The data mining module may have a plurality of dispatchers configured to operate independently of each other. The data mining module receives URL data for analysis, and separates the URL data into work units of URL strings. The method further provides for determining whether one of the plurality of dispatchers is available for receiving a work unit, and sending the URL to one of the dispatchers if it is available.
- In yet another embodiment, a system for collecting data about URLs is provided. The system may include a database for storing information about URLs. The system may also include a pool of dispatchers which include asynchronous system processes each configured to receive URL data input and perform actions on the data. The system may also include a driver module configured to monitor the pool of dispatchers for available dispatchers, and send part of the URL data input to the available dispatchers.
- In still another embodiment, a system for identifying candidate URLs from a set of uncategorized URLs include means for storing the uncategorized URLs, means for collecting information related to the uncategorized URLs, and means for identifying the uncategorized URLs having a characteristic indicative of targeted content.
- In this description, reference is made to the drawings wherein like parts are designated with like numerals throughout.
-
FIG. 1 is a block diagram of various components of a system in accordance with aspects of the invention. -
FIG. 2 is a block diagram of a workstation module fromFIG. 1 . -
FIG. 3 is a block diagram of a gateway server module fromFIG. 1 . -
FIG. 4 is an example of a logging database. -
FIG. 5 is an example of a URL Access Policy database table. -
FIGS. 6A and 6B are examples of categorized and uncategorized URLs, respectively. -
FIG. 7 . is a block diagram of a database management module fromFIG. 1 . -
FIG. 8 is a block diagram of a collection system fromFIG. 7 . -
FIG. 9 is a block diagram of a collection module fromFIG. 8 . -
FIG. 10 shows a honey client system according to some aspects of the invention. -
FIG. 11 is an example of URL-related data collected by the collection module fromFIG. 9 . -
FIG. 12 is a flowchart describing how URLs may be handled in the gateway server module in one embodiment. -
FIG. 13 is a flowchart describing how URLs may be handled by the gateway server module in conjunction with the policy module according to certain embodiments. -
FIG. 14 is a flowchart describing the how the collection system may handle a URL within the gateway server module. -
FIG. 15 is a flowchart describing the how the collection system may handle a URL within the database management module. -
FIG. 16 is a flowchart describing how the honey client control server may be used to collect URL data. -
FIG. 17 is a flowchart describing how data collected by the collection system may be further supplemented to allow for detailed analysis. -
FIG. 18 is a block diagram of a data mining system. - Certain embodiments provide for systems and method of identifying and categorizing web content, including potentially executable web content and malicious content, that is found at locations identified by Uniform Resource Locators (URLs). As used herein, potentially executable web content generally refers to any type of content that includes instructions that are executed by a web browser or web client computer. Potentially executable web content may include, for example, applets, executable code embedded in HTML or other hypertext documents (including script languages such as JavaScript or VBScript), executable code embedded in other documents, such as Microsoft Word macros, or stylesheets. Potentially executable web content may also refer to documents that execute code in another location such as another web page, another computer, or on the web browser computer itself. For example, a HTML web page that includes an “OBJECT” element, and thus can cause execution of ActiveX or other executable components, may generally be considered potentially executable web content regardless of the location of the executable components. Malicious content may refer to content that is not executable but which is calculated to exploit a vulnerability on a client computer. However, potentially executable web content may also be malicious content. For example, image files have been used to exploit vulnerabilities in certain operating systems when those images are processed for display. Moreover, malicious web content may also refer to interactive content such as “phishing” schemes in which a HTML form or other web content is designed to appear to be provided by another, typically trusted, web site such as a bank, in order to deceive the user into providing credentials or other sensitive information to an unauthorized party.
-
FIG. 1 provides a top level illustration of an exemplary system. The system includes anetwork 110. Thenetwork 110 may be a local area network, a wide area network, or some other type of network. Thenetwork 110 may include one ormore workstations 116. Theworkstations 116 may be various types of client computers that are attached to the network. Theclient computers 116 may be desktop computers, notebook computers, handheld computers or the like. The client computers may also be loaded with operating systems that allow them to utilize the network through various software modules such as web browsers, e-mail programs, or the like. - Each of the
workstations 116 may be in electrical communication with agateway server module 120. The gateway server module may reside at the edge of thenetwork 110 so that traffic sent to and from theInternet 112 may pass through it on its way into or out of thenetwork 110. Thegateway server module 120 may take the form of a software module that is installed on a server that stands as a gateway to awider area network 112 than thenetwork 110 to which theworkstations 116 are directly attached. Also connected to theInternet 112 is adatabase management module 114. The database management module also may be a software module (or one or more hardware appliances) which resides on one or more computing devices. Thedatabase management module 114 may reside on a machine that includes some sort of network connecting hardware, such as a network interface card, which allows thedatabase management module 114 to send and receive data and information to and from theInternet 112. - Referring now to
FIG. 2 , a more detailed view of theworkstation 116 is presented. Theworkstation 116 may include aworkstation module 130. Theworkstation module 130 may take the form of software installed to run on the operating system of theworkstation 116. Alternatively, theworkstation module 130 could be an application running on another machine that is launched remotely by theworkstation 116. - The
workstation module 130 may include various components. The workstation module may include an inventory of a localactive content module 132 which records all web content stored on theworkstation 116. For example, the localcontent inventory module 132 may periodically inventory all local content. The inventoried data may be uploaded to thegateway server module 120 for comparison to a categorized URL/content database 146 (discussed in further detail below). The localcontent inventory module 132 may determine whether new content is being introduced to theworkstation 116 by comparison to the inventoried local content contained therein. - The workstation module also may include an upload/
download module 134 and aURL request module 136. The upload/download module 134 may be used to send and receive data from thenetwork 110, through thegateway server module 120 and to theInternet 112. TheURL request module 136 receives a URL input from either a user or some system process, and may send a request via thegateway server module 120 to retrieve the file and/or content associated with that URL. Typically, the functions of each of the upload/download module 134 and theURL request module 136 may be performed by a software applications such as web browsers, with Internet Explorer®, Mozilla Firefox, Opera, Safari, being examples of browsing software well-known in the art. Alternatively, the functions of the modules may be divided among different software applications. For example, an FTP application may perform the functions of the upload/download module 134, while a web browser my perform URL requests. Other types of software may also perform the functions of the upload/download module 134. Although these types of software are generally not desirable on a workstation, software such as Spyware, or Trojan Horses may make requests to send and receive data from the Internet. - The
workstation module 130 may be in communication with thegateway server module 120. Thegateway server module 120 may be used to analyze incoming and outgoing web traffic and to make various determinations about the impact the traffic may have on theworkstations 116. Referring now toFIG. 3 , an example of thegateway server module 120 is provided. Thegateway server module 120 is in two way communication with theworkstation 116. It may receive file uploads and downloads and URL requests from theworkstation module 130. Thegateway server module 120 is also in two way communication with theInternet 112. Thus, requests originating within theworkstations 116 of thenetwork 110 may be required to pass through thegateway server module 120 as they proceed to the Internet. In some embodiments, thegateway server module 120 may be integrated with some firewall hardware or software that protects thenetwork 110 from unauthorized intrusions from theInternet 112. In other embodiments, thegateway server module 120 may be a standalone hardware appliance or even a software module installed on a separate gateway server residing at the network gateway to theInternet 112. - As discussed above, the
gateway server module 120 may receive URL requests and upload/download data from theworkstation 116 by way of theworkstation module 130. Thegateway server module 120 may include various components that perform various functions based on the data received. - One feature included in the
gateway server module 120 is a categorizedURL database 146. TheURL database 146 may be used to store information about URLs including data that is associated with the URLs. The categorizedURL database 146 may be a relational database, or it may be stored in some other form such as a flat file, an object-oriented database, and may be accessed via an application programming interface (API), or some database management software (DBMS). TheURL database 146 may generally be used to help determine whether URL requests sent by theURL request module 136 will be permitted to be completed. In one embodiment, the URLs stored in theURL database 146 are categorized. - The
gateway server module 120 may also include apolicy module 142. Thepolicy module 142 may used to implement network policies regarding how certain content will be handled by thegateway server module 120 or by a firewall or some other security software installed within thenetwork 110. In one embodiment, thepolicy module 142 may be configured to provide the system guidance on how to handle URL requests for categorized URLs. For example, thegateway server module 120 may be configured to disallow URL requests that are categorized as being “Malicious” or “Spyware.” In other embodiments, thepolicy module 142 may be used to determine how to handle URL requests that have not been categorized. In one embodiment, the system may be configured to block all requests for URLs that are not in the categorizedURL database 146. Thepolicy module 142 may also be configured to allow certain requests of uncategorized URLs based on the user making the request or the time at which the request is made. This allows the system to avoid having a one-size-fits-all configuration when such as configuration would not meet the business needs of the organization running thegateway server module 120. - The
gateway server module 120 may include acollection module 140. Thecollection module 140 may be a software program, routine, or process that is used to collect data about URLs. In one embodiment, when a request for a particular URL is received from theURL request module 136, thecollection module 140 may be configured to visit the URL and download the page data to thegateway server module 120 for analysis by components of thegateway server module 120. The downloaded data may also be sent via theInternet 112 for delivery to the database management module 114 (as will be discussed in further detail below). - In some embodiments, the
gateway server module 120 may also include alogging database 144. Thelogging database 144 may perform various functions. For example, it may store records of certain types of occurrences within thenetwork 110. In one embodiment, thelogging database 144 may be configured to record each event in which an uncategorized URL is requested by aworkstation 116. In some embodiments, thelogging database 144 may also be configured to record the frequency with which a particular uncategorized URL is requested. This information may be useful in determining whether an uncategorized URL should be of particular importance or priority and should be categorized by thedatabase management module 114 ahead of earlier received data. In some embodiments, uncategorized URLs may be stored separately in anuncategorized URL database 147. - For example, some spyware may be written to request data from a particular URL. If
many workstations 116 within thenetwork 110 are infected with the spyware, repeated requests to a particular URL may provide an indication that some anomaly is present within the network. The logging database may also be configured to record requests of categorized URL data. In some embodiments, categorizing requests of categorized URLs may be helpful in determining whether a particular URL has been mischaracterized. - Referring now to
FIG. 4 , an example of thelogging database 144 is discussed. Thelogging database 144 includes four columns of data. The first column, “No. Page Requests” 152 is indicative of the number of times a particular URL has been requested by users within thenetwork 110. The second column “URL” 154 records the particular URL string that is being logged in thelogging database 144. Thus, when a URL is sent to thelogging database 144, the database may first be searched to determine whether the URL string is already in it. If not, then the URL string may be added to the database. In some embodiments, thecollection module 140 may be configured to visit the requested URL and gather data about the URL. Thecollection module 140 may retrieve the page source of the requested URL and scan it for certain keywords that may indicate a type of content. For example, if the page source includes “javascript://” then the page may be identified as having JavaScript. While such content is not inherently dangerous, a web page with JavaScript may have a greater chance of including malicious content designed to exploit how a browser application handles JavaScript function calls. In some embodiments, this data may be stored in thelogging database 144 inJavaScript column 155. The logging database may also receive similar information from pages that include Active-X content and store that content withinActive X column 156. In other embodiments, other types of content may be detected and stored for java applets, VBScript, and the like. - Referring again to
FIG. 3 , thegateway server module 120 may further include anadministrative interface module 148 or “admin module.” Theadmin module 148 may be used to allow network administrators or other technical personnel within an organization to configure various features of thegateway server module 120. In certain embodiments, theadmin module 148 allows the network administrator or some other network management-type to configure thepolicy module 142. - Referring now to
FIG. 5 , an example of a URLaccess policy database 158 is provided. The URLaccess policy database 158 may be used by thepolicy module 142 to implement policies for accessing web-based content byworkstations 116 within thenetwork 110. In the embodiment shown the URLaccess policy database 158 includes a table with four columns. The first column is auser column 160. The “User”column 160 includes data about the users that are subject the policy defined in a given row of the table. The next column, “Category” 162, lists the category of content to which the policy defined by that row is applicable. The third column, “Always Block” 164 represents the behavior or policy that is implemented by the system when the user andcategory 166 of requested content match the user and category as defined in that particular row. In one embodiment, the “Always Block” field may be a Boolean-type field in which the data may be set to either true or false. Thus, in the first row shown in the data table, thepolicy module 142 is configured to “always block” requests for “malicious content” by user “asmith.” - As noted above, the policy module may also be configured to implement policies based on different times. In the embodiment provided in
FIG. 5 , the fourth column “Allowed Times” 166 provides this functionality. The second row of data provides an example of how time policies are implemented. Theuser 164 is set to “bnguyen” and thecategory 162 is “gambling.” The policy is not configured to “always block” gambling content for “bnguyen,” as indicated by the field being left blank. However, the time during which these URL requests are permitted is limited to from 6PM to 8AM. Thus, adopting these types of policies allows network administrators to provide a certain degree of flexibility to workstations and users, but to do so in a way that network traffic is not compromised during typical working hours. -
FIGS. 6A and 6B provide illustrations of how the categorizedURL database 146 may store categorized data. In one embodiment, the categorized URLs may be stored in a two-column database table such as the one shown inFIG. 6A . In one embodiment, the table may include aURL column 172 which may simply store the URL string that has been characterized. TheCategory column 174 may store data about the how that URL has been characterized by database module 114 (as will be described in detail below). In one embodiment, the URL field may be indexed so that it may be more quickly searched in real time. Because the list of categorized URLs may reached well into the millions of URLs, a fast access routine is beneficial. - Referring now to
FIG. 6B , the table ofuncategorized URLs 147 is provided (described earlier in connection withFIG. 3 ). This table may be populated by URL requests from theworkstation 116 which request URLs that are not present in the categorized URL table 146. As will be described in greater detail below, thegateway server module 120 may be configured to query the categorizedURL database 146 to determine whether a requested URL should be blocked. If the requested URL is in the categorizeddatabase 146 the policy module may determine whether to allow the request to proceed to theinternet 112. If the requested URL is not found in the categorized URL database, however, it may be added to the list of uncategorized URLs 176 so that it may be sent to thedatabase management module 114 via theInternet 112 and later analyzed and categorized and downloaded into the database of categorizedURLs 146. -
FIG. 7 is an illustration of various components that may be included in thedatabase management module 114. As discussed above, thedatabase management module 114 may be located remotely (accessible via Internet 112) from thenetwork 110 and its associatedworkstations 116. The database management module may take the form of one or many different hardware and software components such as a server bank that runs hundreds of servers simultaneously to achieve improved performance. - In one embodiment, the
database management module 114 may include an upload/download module 178. The upload/download module 178 may be a software or hardware component that allows thedatabase management module 114 to send and receive data from theInternet 112 to any number of locations. In one embodiment, the upload/download module is configured to send newly categorized URLs togateway server modules 120 on theInternet 112 for addition to theirlocal URL databases 146. - The
database management module 114 may also include a URL/content database 180. The URL/content database 180 may take the form of a data warehouse which stores URL strings and information about URLs that have been collected by thecollection system 182. The URL/content database 180 may be a relational database that is indexed to provide quick and effective searches for data. In certain embodiments, the URL database may be a data warehousing application which spans numerous physical hardware components and storage media. The URL database may include data such as URL strings, the content associated with those strings, information about how the content was gathered (e.g., by a honey client, by a customer submission, etc.), and possibly the date in which the URL was written into the URL/content database 180. - The
database management module 114 may further include atraining system 184. Thetraining system 184 may be a software/hardware module which is used to define properties and definitions that may be used to categorize web-based content. Thedatabase management module 114 may further provide a scoring/classification system 186 which utilizes the definitions and properties created by thetraining system 184 to provide a score or classification (e.g., a categorization) to web content so that the categorization may be delivered via the upload/download module 178 togateway server modules 120. - With reference now to
FIG. 8 , a more detailed view of thecollection system 182 is provided. Thecollection system 182 may include acollection module 190 which is coupled (either directly or indirectly) to adata mining module 192. Thecollection module 190 may be used by thedatabase management module 114 to collect data for the URL/content database 180 about URLs that have not been categorized. The collection module may also be used to collect URLs for additional analysis by other system components. Thecollection module 190 may be associated with one ormore collection sources 194 from which it may collect data about URLs. Collection sources may take various forms. In some embodiments, thecollection sources 194 may include active and passive honeypots and honey clients, data analysis oflogging databases 144 stored ongateway server module 120 to identify applications, URLs and protocols for collection. The collection sources may also be webcrawling applications that search theInternet 112 for particular keywords or search phrases within page content. The collection sources 194 may also include URLs and IP addresses data mined from a DNS database to identify domains that are associated with known malicious IP addresses. In some embodiments, URLs for categorization may be collected by receiving malicious code and malicious URL samples from other organizations who share this information. In yet other embodiments, URLs may be collected via e-mail modules configured to receive tips from the public at large, much in the way that criminals are identified through criminal tip hotlines. - Referring now to
FIG. 9 , a more detailed view of thecollection module 190 is provided. Thecollection module 190 may include various subcomponents that allow it to effectively utilize each of the collection sources described above. Thecollection module 190 may include a searchphrase data module 197 and aexpression data module 198. The searchphrase data module 197 collects and provides search phrases that may be relevant to identifying inappropriate content. Theexpression data module 198 may include various types of expressions such as regular expressions, operands, or some other expression. The searchphrase data module 197 and theexpression data module 198 each may include updatable record sets that may be used to define the search parameters for the webcrawling collection source 194. Thecollection module 190 may also include apriority module 200. Thepriority module 200 may take the form of a software process running within thecollection system 182, or it may run as a separate process. The priority module may be used to prioritize the data collected by the collection module in order to have more potentially dangerous or suspect URLs (or data) receive close inspection prior to the likely harmless URLs. In one embodiment, thepriority module 200 may assign priority based on thecollection source 194 from which the URL is received. For example, if a URL is received from a customer report, it may be designated with a higher priority. Similarly, if the URL is received from a web crawler accessing a domain or IP address or subnet known to host malicious content in the past, the URL may receive a high priority. Similarly, a potentially dangerous website identified by a honey client (discussed in further detail below) may also receive a high priority. Thecollection module 190 may also include adata selection module 202 which may work with thepriority module 200 to determine whether identified URLs should be tagged as candidate URLs for categorization. In one embodiment, the data selection URL may provide a user interface for receiving search parameters to further refine the prioritized data by searching for data based on priority and content. - As indicated above, the collection module may also include a
data download module 204. Thedata download module 204 may be configured to identify URLs to visit and to download data and content from the visited URLs. The data download module may work in conjunction with various subsystems in the collection module to retrieve data for the URL/content database 180. One such subsystem is thewebcrawler module 206. Thewebcrawler module 206 may be a software application configured to access websites on theInternet 112 by accessing web pages and following hyperlinks that are included in those pages. Thewebcrawler module 206 may be configured with several concurrent processes that allow the module to simultaneously crawl many websites and report the visited URLs back to the URL/content database 180 as will be discussed in further detail below. Thecollection module 190 may also include ahoney client module 208. Thehoney client module 208 is a software process configured to mimic the behavior of a web browser to visit websites in such a manner that is inviting to malicious code stored within the visited pages. Thehoney client module 208 may visit the web sites and track the behavior of the websites and download the content back to the URL/content database 180 for further analysis. - The
download module 204 may also include a thirdparty supplier module 212 which is configured to receive URLs and associated content from third parties. For example, thethird party module 212 may be configured to provide a website which may be accessed by the general public. The module may be configured to receive an input URL string which may then be entered into the URL/content database 180. In some embodiments, the third party module may also be configured to receive e-mails from private or public mailing lists, and to identify any URL data embedded within the e-mails for storage in the URL/content database 180. - The download module may also include a gateway
server access module 210. The gateway server access module is a software component or program that may be configured to regularly access thelogging database 144 on thegateway server module 120 to download/upload all of the newly uncategorized web content identified by thelogging database 144. - Referring back to
FIG. 8 , the collection system may also include adata mining module 192. Thedata mining module 192 may be used to obtain additional data about URLs stored in the URL/content database 180. In many instances, the information supplied by thecollection sources 194 to thecollection module 190 and URL/content database 180 is limited to nothing more than a URL string. Thus, in order for the system to effectively categorize the content within that URL, more data may be necessary. For example, the actual page content may need to be examined in order to determine whether there is dangerous content embedded within the URL. Thedata mining module 192 is used to collect this additional necessary data about the URLs, and will be discussed in further detail below. -
FIG. 10 provides a more detailed view of ahoney client system 208. Thehoney client system 208 includescontrol servers 220. Thecontrol servers 220 are used to control a plurality ofhoney miners 222 which are configured to visit web sites and mimic human browser behavior in an attempt to detect malicious code on the websites. Thehoney miners 222 may be passive honey miners or active honey miners. A passive honey miner is similar to a web crawler as described above. However, unlike the web crawler above which merely visits the website and reports the URL links available from that site, the passive honey miners may be configured to download the page content and return it to thecontrol servers 220 for insertion into the URL/content database 180 or into some other database. Thehoney miners 222 may be software modules on a single machine, or alternately, they may be implemented each on a separate computing device. - In one embodiment, each control server may control 16
passive honey miners 222. Thecontrol servers 220 may extract or receive URLs from the URL/content database 180 which need additional information in order to be fully analyzed or categorized. Thecontrol servers 220 provide the URLs to the miners which in turn review the URLs and store the collected data. When apassive miner 222 is finished with a particular URL, it may request another URL from itscontrol server 222. In some embodiments, theminers 222 may be configured to follow links on the URL content so that in addition to visiting URLs specified by thecontrol server 220, the miners may visit content that it linked to those URLs. In some embodiments, theminers 222 may be configured to mine to a specified depth with respect to each original URL. For example, theminers 222 may be configured to mine down through four layers of web content before requesting new URL data from thecontrol server 220. - In other embodiments, the
control servers 220 may be configured to controlactive honey miners 222. In contrast to the passive honey miners which only visit web sites and store the content presented on the sites, theactive honey miners 222 may be configured to visit URLs and run or execute the content identified on the sites. In some embodiments, theactive honey miners 222 include web browsing software that is configured to visit websites and access content on the websites via the browser software. The control server 220 (or the honey miners themselves 222) may be configured to monitor the characteristics of thehoney miners 222 as they execute the content on the websites they visit. In one embodiment, thecontrol server 220 will record the URLs that are visited by the honey miners as a result of executing an application or content on the websites visited. Thus,active honey miners 222 may provide a way to more accurately track system behavior and discover previously unidentified exploits. Because the active honey miners expose themselves to the dangers of executable content, in some embodiments, theactive honey miners 222 may be located within a sandbox environment, which provides a tightly-controlled set of resources for guest programs to run in, in order to protect the other computers from damage that could be inflicted by malicious content. In some embodiments, the sandbox may take the form of a virtual machine emulating an operating system. In other embodiments, the sandbox may take the form of actual systems that are isolated from the network. Anomalous behavior may be detected by tracking in real-time, changes made to the file system on the sandbox machine. In some embodiments, the code executed by theactive honey miners 222 may cause the machine on which they are running to become inoperable due to malicious code embedded in the webpage content. In order to address this issue, the control server may control a replacement miner which may step in to complete the work of ahoney miner 222 which is damaged during the mining process. - Referring now to
FIG. 11 , an example of a set of URL-related data that has been collected by the collection system is provided. Although a particular example of collected data is provided, one of skill in the art will appreciate that other data might be collected in addition to the data provided in this example. Included in the collected data is anIP address 230 for the URL. TheIP address 230 may be used to identify websites that are hosting multiple domains of questionable content under the same IP address or on the same server. Thus, if a URL having malicious content is identified as coming from a particular IP address, the rest of the data in the URL/content database 180 may be mined for other URLs having the same IP address in order to select them and more carefully analyze them. The collected URL data may also include aURL 232 as indicated by the second column inFIG. 11 . In instances where the data is collected using a mining process such as the honey client process described above, theURL 232 may often include various pages from the same web domains, as the miners may have been configured to crawl through the links in the websites. The collected data may also include thepage content 234 for a particular URL. Because the content of a URL may be in the form of graphics, text, applications and/or other content, in some embodiments, the database storing this URL data may be configured to store the page content as a binary large object (blob) or application objects in the data record. However, as some web pages contain text exclusively, thepage content 234 may be stored as text as well. In some embodiments, the collection routine may be configured to determine whether the URL contains executable content. In these instances, the resultant data set of collected data may include an indication of whether the URL hasexecutable content 236 within its page code. This information may be later used in selecting data from the URL/content database 180 has candidate data for analysis. - As discussed above in connection with
FIG. 3 , in some embodiments, thegateway server module 120 may be configured to control access to certain URLs based on data stored in the categorizedURL database 146.FIG. 12 is a flowchart describing an embodiment in which the gateway server module handles a request from aworkstation 116. - At
block 1200, theworkstation 116 requests a URL from theInternet 112. This request is intercepted at the Internet gateway and forwarded to thegateway server module 120 atblock 1202. Atblock 1204, the categorizedURL database 146 is queried to determine if the requested URL is stored in thedatabase 146. If the requested URL is found as a record in the database, the process moves on to block 1206, where it analyzes the URL record to determine whether the category of the URL is one that should be blocked for the workstation user. If the category is blocked, the process skips to block 1212 and the request is blocked. If the category is not blocked, however, the request is allowed atblock 1208. - If the requested URL is not found as a record in the categorized
URL database 146 atblock 1204, the system proceeds to block 1210. Atblock 1210, the system determines how to handle the uncategorized content. In some embodiments, the system may utilize thepolicy module 142 to make this determination. If thegateway server module 120 is configured to block requests for uncategorized content, the process moves to block 1212, and the request is blocked. If, on the other hand, the module is configured to allow these types of uncategorized requests, the process moves to block 1208, where the request is allowed to proceed to theInternet 112. - In some embodiments, the request of URL data may result in new records being added to the
logging database 144. These records may be later transferred to thedatabase management module 114 for further analysis. Referring now toFIG. 13 , another flowchart describing a process by which the gateway server module may handle a URL request is provided. Atblock 1300, thegateway server module 120 receives a request for a URL. As noted above, this request may come from aworkstation 116. Atblock 1302, the URL is then compared against the categorizedURL database 146, and the system determines atblock 1304 whether the requested URL is in the categorized URL database. - If the URL is already in the categorized
URL database 146, the process skips to block 1308. If the requested URL is not found in the categorizedURL database 146, however, the process moves to block 1306 where the URL is inserted into theuncategorized URL database 147. (In some embodiments, thelogging database 144 and theuncategorized URL 147 database may be the same database.) After inserting the URL into the database, the method proceeds to block 1308. Atblock 1308, the policy database is checked for instructions on how to handle the received URL. Once thepolicy module 142 has been checked, thelogging database 144 is updated to record that the URL has been requested atblock 1310. After updating thelogging database 144, if theworkstation 116 is permitted to access the URL by the policy database, the process moves to block 1314 and the URL request is sent to theInternet 112. If, however, the policy database does not allow the request, the process skips to block 1316 and the request is blocked. - In some embodiments, the
gateway server module 120 may perform collection to lessen the burden on thecollecting system 182 of thedatabase management module 114.FIG. 14 provides an example of a system in which the gatewayserver collection module 140 is used to collect data about an uncategorized URL. Atblock 1400, the gateway server module receives a request for a URL. Next, atblock 1402, the requested URL is compared against the categorized URL database. If the system determines that the requested URL is in the URL database atblock 1404, the process moves to block 1410, where the request is either forwarded to theInternet 112 or blocked depending on how the URL is categorized. - If the requested URL is not in the categorized
URL database 146, the process moves to block 1406 where the URL is sent to thegateway collection module 140. Next, atblock 1408, thecollection module 140 collects URL data about the requested URL. In some embodiments, this data may be stored in theuncategorized URL database 147. Alternatively, this data may simply be forwarded to thedatabase management module 114 via theInternet 112. Once the data has been collected and stored, the process moves to block 1410 where the URL request is either allowed or blocked based on the policies indicated in thepolicy module 142. - As discussed previously, uncategorized URL data may be sent from the
gateway server module 120 to thedatabase management module 114 for further analysis so that the URL may be categorized and added to the categorizedURL database 146. However, because the volume of uncategorized data is so large at times, it may not be possible to categorized all of the received data without compromising accuracy. As a result, in some instances, it may be desirable to identify candidate URLs within the uncategorized data that are most likely to present a threat toworkstations 116 andnetworks 110. -
FIG. 15 provides an example of a method for identifying candidate URLs for further analysis. The method starts with a URL being received into thecollection system 182 of thedatabase module 114. Atblock 1502, the URL or application is preprocessed to determine whether it carries a known malicious data element or data signature. Next, atblock 1504, if the system determines that the URL includes a known malicious element, the process skips to block 1514 where the URL is tagged as a candidate URL and sent to thetraining system 184 for further analysis. If the initial analysis of the URL inblock 1504 does not reveal a malicious element, the process moves to block 1506, where the URL is added to a database of potential candidate URLs. Next, atblock 1508, thedata mining module 192 is configured to select URLs from sources 194 (of which the database of potential candidate URLs is one) based on preconfigured conditions such as attack strings, virus signatures, and the like. The data set including all of thedata sources 194 is then sent to thedata mining module 192 atblock 1510, where each URL is analyzed by thedata mining module 192 atblock 1512. If the URL satisfies the defined preconfigured conditions, the process moves tobock 1514 where the URL is tagged as a candidate URL and sent on to the scoring/classification system 186 for additional analysis. If, however, the URL does not meet the conditions specified for converting it to a candidate URL, the method proceeds to block 1516 and the URL is not tagged as a candidate. Although this embodiment is described in the context of URL candidate classification, one of skill in the art will readily appreciate that applications may be similarly analyzed and tagged as candidates using the process described above. - In another embodiment, the system may utilize the
honey client system 208 in conjunction with thedata mining system 192 to collect URLs to be added to the candidate URL list for classification.FIG. 16 illustrates an example of a process for collecting this data. Atblock 1600, the honeyclient control server 220 is launched. Thecontrol server 220 then launches one ormore honey miners 222 atblock 1602. Next, atblock 1604, thehoney miners 222 visit the next URL provided to them by thecontrol servers 220 and parse the page source of that URL to determine if there is active content in the URL atblock 1606. If no active content is found in the page, the process skips to block 1610. If however, active content is found the process moves to block 1608 where the URL is added to the candidate URL list. - Next at
block 1610, theminer 222 determines whether the current URL contains hyperlinks or forms. If no hyperlinks or forms are found, the process loops back to block 1604 where the miner receives another URL from thecontrol server 222 for analysis. If, however, the URL contains hyperlinks or forms, the method proceeds to block 1612 where it then determines whether the URL includes hidden links or forms. Because many malicious websites wish to avoid detection by mining software such as thehoney clients systems 208, they include hidden hyperlinks that are not visible when browsed by a human. Thus, the website can detect a miner by hiding these links as “bait.” One technique used to hide the links is to make them the same color as the background of the web page. If the miner follows the links, then the website is alerted to its presence. - In the method provided in
FIG. 16 , the miner is configured to detect these hidden links. If no hidden links are present, the process skips to block 1618, and the miner continues by following the non-hidden links that are in the URL content. If however, any hidden links are present, atblock 1614, the URL and its hidden links are added to the classification list and passed over atblock 1616. Once the hidden links have been processed (i.e., added to the classification list), the method then proceeds to block 1618 where the non-hidden links are followed. - In some embodiments, URL data is added to the URL/
content database 180 without all of the necessary data for full analysis by the scoring/classification system 186. For example, sometimes the only data received about a URL from acollection source 194, is the URL string itself. Thus, it may become necessary to collect additional data about URLs in order properly analyze them. Referring now toFIG. 17 , a process is shown describing how the system may handle candidate URLs according to one embodiment. Atblock 1700, data from a collection source is added to the URL/content database 180. As discussed previously, the URL/content database 180 may be a data warehouse. Next, atblock 1702, the system looks at the URL data and determines whether there is missing content that is necessary for analysis. In some configurations, if the content of the URL is not in the data warehouse, the system determines that more data is needed and sends the URL to the data mining module for supplementation atblock 1704. The data mining module then may take the data received and collect additional data. If no content is missing, the URL is immediately sent to the scoring/classification module 186 for further analysis atblock 1706. - As discussed above, one of the challenges to collecting and analyzing Internet data to determine whether it includes harmful active content is the sheer volume of data that must be collected and analyzed. In yet another embodiment, the
data mining module 192 may be used to address these issues by collecting large volumes of relevant data utilize system resources effectively and efficiently. Referring now toFIG. 18 , a more detailed block diagram of thedata mining system 192 is provided. Thedata mining system 192 may take the form of a software module that runs a plurality of asynchronous processes to achieve maximum efficiency and output. Thedata mining system 192 may include a plug-inmodule 242 which receives configuration parameters which provide instruction on how inputted data should be handled. In one embodiment, the instructions received by the plug-in module may take the form of an HTTP protocol plug-in that provide parameters for thedata mining system 192 to receive URL data and analyze and supplement the data based on various HTTP-related instructions implemented by the data mining system on the URL data. In another embodiment, the plug-in may be geared toward mining some other protocol such as FTP, NNTP, or some other data form. - The
data mining system 192, which may also be used to implement passive honey clients, may also include apool 246 ofdispatchers 248. Thedispatchers 248 are individual asynchronous processing entities that receive task assignments based on the data input (for analysis) into the data mining system and the configuration data received by the plug-inmodule 242. Thepool 246 is a collection of the dispatchers that is controlled by adriver 244. Thedriver 244 is a managing mechanism for the pool. Thedriver 244 may be configured to monitor the activity of thedispatchers 248 in thepool 246 to determine when to send additional data into thepool 246 for mining and analysis. In one embodiment, the driver may be configured to send new data units into thepool 246 whenever anydispatchers 248 are idle. In one embodiment, thedriver 244 may be utilized as a control server for managinghoney client miners 222 as described above in connection withFIG. 10 . Thepool 246 may deliver the data unit to theidle dispatcher 248. Thedispatcher 248 reads the plug-in configuration and performs actions in accordance with plug-in 242. - In one embodiment, the plug-in module may receive an HTTP plug-in. The HTTP plug-in may be configured to receive input data in the form of URL strings about which the
data mining system 192 will obtain addition information such as the page content for the URL, HTTP messages returned by the URL when accessed (such as “4xx—file not found” or “5xx—server error”). The plug-in may further specify a webcrawling mode in which the dispatches, in addition to collecting page content, also add URL links within the URL content to the URL data set to be analyzed. - As used herein, “database” refers to any collection of stored data stored on a medium accessible by a computer. For example, a database may refer to flat data files or to a structured data file. Moreover, it is to be recognized that the various illustrative databases described in connection with the embodiments disclosed herein may be implemented as databases that combine aspects of the various illustrative databases or the illustrative databases may be divided into multiple databases. For example, one or more of the various illustrative databases may be embodied as tables in one or more relational databases. Embodiments may be implemented in relational databases, including SQL databases, object oriented databases, object-relational databases, flat files, or any other suitable data storage system.
- The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
- The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal. It will be understood by those of skill in the art that numerous and various modifications can be made without departing from the spirit of the present invention. Therefore, it should be clearly understood that the forms of the invention are illustrative only and are not intended to limit the scope of the invention.
Claims (16)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/164,688 US8978140B2 (en) | 2006-07-10 | 2011-06-20 | System and method of analyzing web content |
US14/642,561 US9723018B2 (en) | 2006-07-10 | 2015-03-09 | System and method of analyzing web content |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/484,240 US8020206B2 (en) | 2006-07-10 | 2006-07-10 | System and method of analyzing web content |
US13/164,688 US8978140B2 (en) | 2006-07-10 | 2011-06-20 | System and method of analyzing web content |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/484,240 Continuation US8020206B2 (en) | 2006-07-10 | 2006-07-10 | System and method of analyzing web content |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/642,561 Continuation US9723018B2 (en) | 2006-07-10 | 2015-03-09 | System and method of analyzing web content |
Publications (2)
Publication Number | Publication Date |
---|---|
US20110252478A1 true US20110252478A1 (en) | 2011-10-13 |
US8978140B2 US8978140B2 (en) | 2015-03-10 |
Family
ID=38740351
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/484,240 Active 2030-04-14 US8020206B2 (en) | 2006-07-10 | 2006-07-10 | System and method of analyzing web content |
US13/164,688 Active US8978140B2 (en) | 2006-07-10 | 2011-06-20 | System and method of analyzing web content |
US14/642,561 Active US9723018B2 (en) | 2006-07-10 | 2015-03-09 | System and method of analyzing web content |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/484,240 Active 2030-04-14 US8020206B2 (en) | 2006-07-10 | 2006-07-10 | System and method of analyzing web content |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/642,561 Active US9723018B2 (en) | 2006-07-10 | 2015-03-09 | System and method of analyzing web content |
Country Status (6)
Country | Link |
---|---|
US (3) | US8020206B2 (en) |
EP (1) | EP2044539A2 (en) |
CN (1) | CN101517570B (en) |
AU (1) | AU2007273085B2 (en) |
CA (1) | CA2656571A1 (en) |
WO (1) | WO2008008219A2 (en) |
Cited By (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20110191455A1 (en) * | 2010-02-02 | 2011-08-04 | Patrick Gardner | Using Aggregated DNS Information Originating from Multiple Sources to Detect Anomalous DNS Name Resolutions |
US8180761B1 (en) * | 2007-12-27 | 2012-05-15 | Symantec Corporation | Referrer context aware target queue prioritization |
US20120167220A1 (en) * | 2010-12-23 | 2012-06-28 | Korea Internet & Security Agency | Seed information collecting device and method for detecting malicious code landing/hopping/distribution sites |
US8479284B1 (en) | 2007-12-20 | 2013-07-02 | Symantec Corporation | Referrer context identification for remote object links |
US20130227640A1 (en) * | 2010-09-09 | 2013-08-29 | NSFOCUS Information Technology Co., Ltd. | Method and apparatus for website scanning |
WO2013162264A1 (en) * | 2012-04-23 | 2013-10-31 | 줌인터넷 주식회사 | Method and system for collecting objects by using packet mirroring |
WO2013184653A1 (en) * | 2012-06-04 | 2013-12-12 | Board Of Regents, The University Of Texas System | Method and system for resilient and adaptive detection of malicious websites |
US20150120692A1 (en) * | 2012-06-30 | 2015-04-30 | Huawei Technologies Co., Ltd. | Method, device, and system for acquiring user behavior |
US9047456B2 (en) | 2012-03-20 | 2015-06-02 | Canon Information And Imaging Solutions, Inc. | System and method for controlling access to a resource |
US20150222660A1 (en) * | 2012-10-18 | 2015-08-06 | Tencent Technology (Shenzhen) Company Limited | Method and apparatus for detecting hidden content of web page |
US10334015B2 (en) * | 2017-04-28 | 2019-06-25 | Bank Of America Corporation | Apparatus and methods for shortening user exposure to malicious websites |
Families Citing this family (325)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7584208B2 (en) | 2002-11-20 | 2009-09-01 | Radar Networks, Inc. | Methods and systems for managing offers and requests in a network |
US7640267B2 (en) | 2002-11-20 | 2009-12-29 | Radar Networks, Inc. | Methods and systems for managing entities in a computing device using semantic objects |
US7433876B2 (en) | 2004-02-23 | 2008-10-07 | Radar Networks, Inc. | Semantic web portal and platform |
US8566946B1 (en) | 2006-04-20 | 2013-10-22 | Fireeye, Inc. | Malware containment on connection |
US8793787B2 (en) | 2004-04-01 | 2014-07-29 | Fireeye, Inc. | Detecting malicious network content using virtual environment components |
US9106694B2 (en) | 2004-04-01 | 2015-08-11 | Fireeye, Inc. | Electronic message analysis for malware detection |
US8171553B2 (en) | 2004-04-01 | 2012-05-01 | Fireeye, Inc. | Heuristic based capture with replay to virtual machine |
US8881282B1 (en) | 2004-04-01 | 2014-11-04 | Fireeye, Inc. | Systems and methods for malware attack detection and identification |
US8528086B1 (en) | 2004-04-01 | 2013-09-03 | Fireeye, Inc. | System and method of detecting computer worms |
US8584239B2 (en) | 2004-04-01 | 2013-11-12 | Fireeye, Inc. | Virtual machine with dynamic data flow analysis |
US7587537B1 (en) | 2007-11-30 | 2009-09-08 | Altera Corporation | Serializer-deserializer circuits formed from input-output circuit registers |
US8898788B1 (en) | 2004-04-01 | 2014-11-25 | Fireeye, Inc. | Systems and methods for malware attack prevention |
US9027135B1 (en) | 2004-04-01 | 2015-05-05 | Fireeye, Inc. | Prospective client identification using malware attack detection |
WO2008021832A2 (en) | 2006-08-09 | 2008-02-21 | Radar Networks, Inc. | Harvesting data from page |
US8312075B1 (en) * | 2006-11-29 | 2012-11-13 | Mcafee, Inc. | System, method and computer program product for reconstructing data received by a computer in a manner that is independent of the computer |
US8099455B2 (en) * | 2007-08-16 | 2012-01-17 | Sony Ericsson Mobile Communications Ab | Notifying remote devices of available content |
US20090076887A1 (en) | 2007-09-16 | 2009-03-19 | Nova Spivack | System And Method Of Collecting Market-Related Data Via A Web-Based Networking Environment |
US7966650B2 (en) * | 2008-02-22 | 2011-06-21 | Sophos Plc | Dynamic internet address assignment based on user identity and policy compliance |
US9264441B2 (en) * | 2008-03-24 | 2016-02-16 | Hewlett Packard Enterprise Development Lp | System and method for securing a network from zero-day vulnerability exploits |
US8359651B1 (en) * | 2008-05-15 | 2013-01-22 | Trend Micro Incorporated | Discovering malicious locations in a public computer network |
US8850571B2 (en) | 2008-11-03 | 2014-09-30 | Fireeye, Inc. | Systems and methods for detecting malicious network content |
US8997219B2 (en) | 2008-11-03 | 2015-03-31 | Fireeye, Inc. | Systems and methods for detecting malicious PDF network content |
US8800040B1 (en) | 2008-12-31 | 2014-08-05 | Symantec Corporation | Methods and systems for prioritizing the monitoring of malicious uniform resource locators for new malware variants |
US9037567B2 (en) * | 2009-04-15 | 2015-05-19 | Vcvc Iii Llc | Generating user-customized search results and building a semantics-enhanced search engine |
US10628847B2 (en) | 2009-04-15 | 2020-04-21 | Fiver Llc | Search-enhanced semantic advertising |
US8200617B2 (en) | 2009-04-15 | 2012-06-12 | Evri, Inc. | Automatic mapping of a location identifier pattern of an object to a semantic type using object metadata |
US8862579B2 (en) | 2009-04-15 | 2014-10-14 | Vcvc Iii Llc | Search and search optimization using a pattern of a location identifier |
CN101527721B (en) * | 2009-04-22 | 2012-09-05 | 中兴通讯股份有限公司 | Anti-virus method on the basis of household gateway and device thereof |
US8370302B2 (en) * | 2009-06-02 | 2013-02-05 | Hitachi, Ltd. | Method and apparatus for block based volume backup |
US8489685B2 (en) | 2009-07-17 | 2013-07-16 | Aryaka Networks, Inc. | Application acceleration as a service system and method |
US8832829B2 (en) | 2009-09-30 | 2014-09-09 | Fireeye, Inc. | Network-based binary file extraction and analysis for malware detection |
CN103870554A (en) * | 2009-12-11 | 2014-06-18 | 北京奇虎科技有限公司 | Method for realizing browser address bar nameplate |
US8813232B2 (en) | 2010-03-04 | 2014-08-19 | Mcafee Inc. | Systems and methods for risk rating and pro-actively detecting malicious online ads |
US8990610B2 (en) * | 2010-03-12 | 2015-03-24 | International Business Machines Corporation | Preferred resource selector |
US8639773B2 (en) * | 2010-06-17 | 2014-01-28 | Microsoft Corporation | Discrepancy detection for web crawling |
US8510829B2 (en) | 2010-06-24 | 2013-08-13 | Mcafee, Inc. | Systems and methods to detect malicious media files |
US8825810B1 (en) * | 2010-07-09 | 2014-09-02 | Open Invention Network, Llc | Domain name service based remote programming objects |
US8595843B1 (en) * | 2010-08-12 | 2013-11-26 | Amazon Technologies, Inc. | Techniques for identifying sources of unauthorized code |
CN101917443A (en) * | 2010-08-26 | 2010-12-15 | 北京天融信科技有限公司 | Security gateway and method thereof for controlling sensitive link |
US8484740B2 (en) | 2010-09-08 | 2013-07-09 | At&T Intellectual Property I, L.P. | Prioritizing malicious website detection |
US8640225B2 (en) * | 2010-09-24 | 2014-01-28 | Nokia Corporation | Method and apparatus for validating resource identifier |
CN102567304B (en) * | 2010-12-24 | 2014-02-26 | 北大方正集团有限公司 | Filtering method and device for network malicious information |
CN102902917A (en) * | 2011-07-29 | 2013-01-30 | 国际商业机器公司 | Method and system for preventing phishing attacks |
CN102843270B (en) * | 2011-09-02 | 2016-01-27 | 哈尔滨安天科技股份有限公司 | The suspicious URL detection method associated with local file based on URL and device |
US9106709B2 (en) * | 2011-09-22 | 2015-08-11 | Opera Software Asa | Server side mobile audience intelligence creation |
US8880389B2 (en) * | 2011-12-09 | 2014-11-04 | Igor Iofinov | Computer implemented semantic search methodology, system and computer program product for determining information density in text |
CN102402620A (en) * | 2011-12-26 | 2012-04-04 | 余姚市供电局 | Method and system for defending malicious webpage |
CN102571812B (en) * | 2011-12-31 | 2014-11-05 | 华为数字技术(成都)有限公司 | Tracking and identification method and apparatus for network threats |
US9519782B2 (en) | 2012-02-24 | 2016-12-13 | Fireeye, Inc. | Detecting malicious network content |
US10572665B2 (en) | 2012-12-28 | 2020-02-25 | Fireeye, Inc. | System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events |
EP2760183A1 (en) * | 2013-01-28 | 2014-07-30 | British Telecommunications public limited company | System for detecting hyperlink faults |
US9824209B1 (en) | 2013-02-23 | 2017-11-21 | Fireeye, Inc. | Framework for efficient security coverage of mobile software applications that is usable to harden in the field code |
US8990944B1 (en) | 2013-02-23 | 2015-03-24 | Fireeye, Inc. | Systems and methods for automatically detecting backdoors |
US9176843B1 (en) | 2013-02-23 | 2015-11-03 | Fireeye, Inc. | Framework for efficient security coverage of mobile software applications |
US9367681B1 (en) | 2013-02-23 | 2016-06-14 | Fireeye, Inc. | Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application |
US9009823B1 (en) | 2013-02-23 | 2015-04-14 | Fireeye, Inc. | Framework for efficient security coverage of mobile software applications installed on mobile devices |
US9195829B1 (en) | 2013-02-23 | 2015-11-24 | Fireeye, Inc. | User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications |
US9159035B1 (en) | 2013-02-23 | 2015-10-13 | Fireeye, Inc. | Framework for computer application analysis of sensitive information tracking |
US9009822B1 (en) | 2013-02-23 | 2015-04-14 | Fireeye, Inc. | Framework for multi-phase analysis of mobile applications |
US9355247B1 (en) | 2013-03-13 | 2016-05-31 | Fireeye, Inc. | File extraction from memory dump for malicious content analysis |
US9104867B1 (en) | 2013-03-13 | 2015-08-11 | Fireeye, Inc. | Malicious content analysis using simulated user interaction without user involvement |
US9626509B1 (en) | 2013-03-13 | 2017-04-18 | Fireeye, Inc. | Malicious content analysis with multi-version application support within single operating environment |
US9565202B1 (en) | 2013-03-13 | 2017-02-07 | Fireeye, Inc. | System and method for detecting exfiltration content |
US9430646B1 (en) | 2013-03-14 | 2016-08-30 | Fireeye, Inc. | Distributed systems and methods for automatically detecting unknown bots and botnets |
US9311479B1 (en) | 2013-03-14 | 2016-04-12 | Fireeye, Inc. | Correlation and consolidation of analytic data for holistic view of a malware attack |
US9251343B1 (en) | 2013-03-15 | 2016-02-02 | Fireeye, Inc. | Detecting bootkits resident on compromised computers |
US10713358B2 (en) | 2013-03-15 | 2020-07-14 | Fireeye, Inc. | System and method to extract and utilize disassembly features to classify software intent |
WO2014145805A1 (en) | 2013-03-15 | 2014-09-18 | Mandiant, Llc | System and method employing structured intelligence to verify and contain threats at endpoints |
CN105144767B (en) * | 2013-04-12 | 2019-07-02 | Sk电信有限公司 | For checking the device and method and user terminal of message |
US9495180B2 (en) | 2013-05-10 | 2016-11-15 | Fireeye, Inc. | Optimized resource allocation for virtual machines within a malware content detection system |
US9635039B1 (en) | 2013-05-13 | 2017-04-25 | Fireeye, Inc. | Classifying sets of malicious indicators for detecting command and control communications associated with malware |
US9536091B2 (en) | 2013-06-24 | 2017-01-03 | Fireeye, Inc. | System and method for detecting time-bomb malware |
US10133863B2 (en) | 2013-06-24 | 2018-11-20 | Fireeye, Inc. | Zero-day discovery system |
US9300686B2 (en) | 2013-06-28 | 2016-03-29 | Fireeye, Inc. | System and method for detecting malicious links in electronic messages |
US9888016B1 (en) | 2013-06-28 | 2018-02-06 | Fireeye, Inc. | System and method for detecting phishing using password prediction |
JP2016527435A (en) * | 2013-07-23 | 2016-09-08 | マヒンドラ・アンド・マヒンドラ・リミテッドMahindra & Mahindra Ltd. | A naturally aspirated common rail diesel engine that is compliant with ultra-low PM emission regulations through self-regenerative exhaust gas aftertreatment. |
US9773126B2 (en) * | 2013-09-17 | 2017-09-26 | Adobe Systems Incorporated | Data collection privacy |
US9294501B2 (en) | 2013-09-30 | 2016-03-22 | Fireeye, Inc. | Fuzzy hash of behavioral results |
US10192052B1 (en) | 2013-09-30 | 2019-01-29 | Fireeye, Inc. | System, apparatus and method for classifying a file as malicious using static scanning |
US9736179B2 (en) | 2013-09-30 | 2017-08-15 | Fireeye, Inc. | System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection |
US9690936B1 (en) | 2013-09-30 | 2017-06-27 | Fireeye, Inc. | Multistage system and method for analyzing obfuscated content for malware |
US9171160B2 (en) | 2013-09-30 | 2015-10-27 | Fireeye, Inc. | Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses |
US10089461B1 (en) | 2013-09-30 | 2018-10-02 | Fireeye, Inc. | Page replacement code injection |
US9628507B2 (en) | 2013-09-30 | 2017-04-18 | Fireeye, Inc. | Advanced persistent threat (APT) detection center |
US10515214B1 (en) | 2013-09-30 | 2019-12-24 | Fireeye, Inc. | System and method for classifying malware within content created during analysis of a specimen |
US9921978B1 (en) | 2013-11-08 | 2018-03-20 | Fireeye, Inc. | System and method for enhanced security of storage devices |
US9189627B1 (en) | 2013-11-21 | 2015-11-17 | Fireeye, Inc. | System, apparatus and method for conducting on-the-fly decryption of encrypted objects for malware detection |
EP3076302B1 (en) * | 2013-11-25 | 2020-04-29 | NEC Corporation | Information collection system, control method, and program |
US9756074B2 (en) | 2013-12-26 | 2017-09-05 | Fireeye, Inc. | System and method for IPS and VM-based detection of suspicious objects |
US9747446B1 (en) | 2013-12-26 | 2017-08-29 | Fireeye, Inc. | System and method for run-time object classification |
CN104125209B (en) * | 2014-01-03 | 2015-09-09 | 腾讯科技(深圳)有限公司 | Malice website prompt method and router |
US9740857B2 (en) | 2014-01-16 | 2017-08-22 | Fireeye, Inc. | Threat-aware microvisor |
US9262635B2 (en) | 2014-02-05 | 2016-02-16 | Fireeye, Inc. | Detection efficacy of virtual machine-based analysis with application specific events |
US9241010B1 (en) | 2014-03-20 | 2016-01-19 | Fireeye, Inc. | System and method for network behavior detection |
US10242185B1 (en) | 2014-03-21 | 2019-03-26 | Fireeye, Inc. | Dynamic guest image creation and rollback |
US9419986B2 (en) * | 2014-03-26 | 2016-08-16 | Symantec Corporation | System to identify machines infected by malware applying linguistic analysis to network requests from endpoints |
US9591015B1 (en) | 2014-03-28 | 2017-03-07 | Fireeye, Inc. | System and method for offloading packet processing and static analysis operations |
US9223972B1 (en) | 2014-03-31 | 2015-12-29 | Fireeye, Inc. | Dynamically remote tuning of a malware content detection system |
US9432389B1 (en) | 2014-03-31 | 2016-08-30 | Fireeye, Inc. | System, apparatus and method for detecting a malicious attack based on static analysis of a multi-flow object |
US9594912B1 (en) | 2014-06-06 | 2017-03-14 | Fireeye, Inc. | Return-oriented programming detection |
US9438623B1 (en) | 2014-06-06 | 2016-09-06 | Fireeye, Inc. | Computer exploit detection using heap spray pattern matching |
US9973531B1 (en) | 2014-06-06 | 2018-05-15 | Fireeye, Inc. | Shellcode detection |
US10084813B2 (en) | 2014-06-24 | 2018-09-25 | Fireeye, Inc. | Intrusion prevention and remedy system |
US10805340B1 (en) | 2014-06-26 | 2020-10-13 | Fireeye, Inc. | Infection vector and malware tracking with an interactive user display |
US9398028B1 (en) | 2014-06-26 | 2016-07-19 | Fireeye, Inc. | System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers |
US10002252B2 (en) | 2014-07-01 | 2018-06-19 | Fireeye, Inc. | Verification of trusted threat-aware microvisor |
US9363280B1 (en) | 2014-08-22 | 2016-06-07 | Fireeye, Inc. | System and method of detecting delivery of malware using cross-customer data |
US10671726B1 (en) | 2014-09-22 | 2020-06-02 | Fireeye Inc. | System and method for malware analysis using thread-level event monitoring |
US9773112B1 (en) | 2014-09-29 | 2017-09-26 | Fireeye, Inc. | Exploit detection of malware and malware families |
US10027689B1 (en) | 2014-09-29 | 2018-07-17 | Fireeye, Inc. | Interactive infection visualization for improved exploit detection and signature generation for malware and malware families |
US9690933B1 (en) | 2014-12-22 | 2017-06-27 | Fireeye, Inc. | Framework for classifying an object as malicious with machine learning for deploying updated predictive models |
US10075455B2 (en) | 2014-12-26 | 2018-09-11 | Fireeye, Inc. | Zero-day rotating guest image profile |
US9934376B1 (en) | 2014-12-29 | 2018-04-03 | Fireeye, Inc. | Malware detection appliance architecture |
US9838417B1 (en) | 2014-12-30 | 2017-12-05 | Fireeye, Inc. | Intelligent context aware user interaction for malware detection |
US10148693B2 (en) | 2015-03-25 | 2018-12-04 | Fireeye, Inc. | Exploit detection system |
US9690606B1 (en) | 2015-03-25 | 2017-06-27 | Fireeye, Inc. | Selective system call monitoring |
US9438613B1 (en) | 2015-03-30 | 2016-09-06 | Fireeye, Inc. | Dynamic content activation for automated analysis of embedded objects |
US10474813B1 (en) | 2015-03-31 | 2019-11-12 | Fireeye, Inc. | Code injection technique for remediation at an endpoint of a network |
US10417031B2 (en) | 2015-03-31 | 2019-09-17 | Fireeye, Inc. | Selective virtualization for security threat detection |
US9483644B1 (en) | 2015-03-31 | 2016-11-01 | Fireeye, Inc. | Methods for detecting file altering malware in VM based analysis |
US9654485B1 (en) | 2015-04-13 | 2017-05-16 | Fireeye, Inc. | Analytics-based security monitoring system and method |
US9594904B1 (en) | 2015-04-23 | 2017-03-14 | Fireeye, Inc. | Detecting malware based on reflection |
US10454950B1 (en) | 2015-06-30 | 2019-10-22 | Fireeye, Inc. | Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks |
US10642753B1 (en) | 2015-06-30 | 2020-05-05 | Fireeye, Inc. | System and method for protecting a software component running in virtual machine using a virtualization layer |
US11113086B1 (en) | 2015-06-30 | 2021-09-07 | Fireeye, Inc. | Virtual system and method for securing external network connectivity |
US10726127B1 (en) | 2015-06-30 | 2020-07-28 | Fireeye, Inc. | System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer |
EP3125147B1 (en) * | 2015-07-27 | 2020-06-03 | Swisscom AG | System and method for identifying a phishing website |
US10715542B1 (en) | 2015-08-14 | 2020-07-14 | Fireeye, Inc. | Mobile application risk analysis |
US10176321B2 (en) | 2015-09-22 | 2019-01-08 | Fireeye, Inc. | Leveraging behavior-based rules for malware family classification |
US10033747B1 (en) | 2015-09-29 | 2018-07-24 | Fireeye, Inc. | System and method for detecting interpreter-based exploit attacks |
US9825976B1 (en) | 2015-09-30 | 2017-11-21 | Fireeye, Inc. | Detection and classification of exploit kits |
US10706149B1 (en) | 2015-09-30 | 2020-07-07 | Fireeye, Inc. | Detecting delayed activation malware using a primary controller and plural time controllers |
US10601865B1 (en) | 2015-09-30 | 2020-03-24 | Fireeye, Inc. | Detection of credential spearphishing attacks using email analysis |
US10210329B1 (en) | 2015-09-30 | 2019-02-19 | Fireeye, Inc. | Method to detect application execution hijacking using memory protection |
US9825989B1 (en) | 2015-09-30 | 2017-11-21 | Fireeye, Inc. | Cyber attack early warning system |
US10817606B1 (en) | 2015-09-30 | 2020-10-27 | Fireeye, Inc. | Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic |
US10284575B2 (en) | 2015-11-10 | 2019-05-07 | Fireeye, Inc. | Launcher for setting analysis environment variations for malware detection |
US10447728B1 (en) | 2015-12-10 | 2019-10-15 | Fireeye, Inc. | Technique for protecting guest processes using a layered virtualization architecture |
US10846117B1 (en) | 2015-12-10 | 2020-11-24 | Fireeye, Inc. | Technique for establishing secure communication between host and guest processes of a virtualization architecture |
US10108446B1 (en) | 2015-12-11 | 2018-10-23 | Fireeye, Inc. | Late load technique for deploying a virtualization layer underneath a running operating system |
US10050998B1 (en) | 2015-12-30 | 2018-08-14 | Fireeye, Inc. | Malicious message analysis system |
US10133866B1 (en) | 2015-12-30 | 2018-11-20 | Fireeye, Inc. | System and method for triggering analysis of an object for malware in response to modification of that object |
US10565378B1 (en) | 2015-12-30 | 2020-02-18 | Fireeye, Inc. | Exploit of privilege detection framework |
US10621338B1 (en) | 2015-12-30 | 2020-04-14 | Fireeye, Inc. | Method to detect forgery and exploits using last branch recording registers |
US11552986B1 (en) | 2015-12-31 | 2023-01-10 | Fireeye Security Holdings Us Llc | Cyber-security framework for application of virtual features |
US10581874B1 (en) | 2015-12-31 | 2020-03-03 | Fireeye, Inc. | Malware detection system with contextual analysis |
US9824216B1 (en) | 2015-12-31 | 2017-11-21 | Fireeye, Inc. | Susceptible environment detection system |
US10404733B1 (en) * | 2016-02-02 | 2019-09-03 | Symantec Corporation | Active push-based remediation for reputation-based security systems |
CN107045507B (en) * | 2016-02-05 | 2020-08-21 | 北京国双科技有限公司 | Webpage crawling method and device |
US10671721B1 (en) | 2016-03-25 | 2020-06-02 | Fireeye, Inc. | Timeout management services |
US10601863B1 (en) | 2016-03-25 | 2020-03-24 | Fireeye, Inc. | System and method for managing sensor enrollment |
US10785255B1 (en) | 2016-03-25 | 2020-09-22 | Fireeye, Inc. | Cluster configuration within a scalable malware detection system |
US10476906B1 (en) | 2016-03-25 | 2019-11-12 | Fireeye, Inc. | System and method for managing formation and modification of a cluster within a malware detection system |
US10893059B1 (en) | 2016-03-31 | 2021-01-12 | Fireeye, Inc. | Verification and enhancement using detection systems located at the network periphery and endpoint devices |
US11004125B2 (en) | 2016-04-01 | 2021-05-11 | OneTrust, LLC | Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design |
US11244367B2 (en) | 2016-04-01 | 2022-02-08 | OneTrust, LLC | Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design |
US20220164840A1 (en) | 2016-04-01 | 2022-05-26 | OneTrust, LLC | Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design |
US10860715B2 (en) * | 2016-05-26 | 2020-12-08 | Barracuda Networks, Inc. | Method and apparatus for proactively identifying and mitigating malware attacks via hosted web assets |
US10510031B2 (en) | 2016-06-10 | 2019-12-17 | OneTrust, LLC | Data processing systems for identifying, assessing, and remediating data processing risks using data modeling techniques |
US10873606B2 (en) | 2016-06-10 | 2020-12-22 | OneTrust, LLC | Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods |
US11366786B2 (en) | 2016-06-10 | 2022-06-21 | OneTrust, LLC | Data processing systems for processing data subject access requests |
US11403377B2 (en) | 2016-06-10 | 2022-08-02 | OneTrust, LLC | Privacy management systems and methods |
US11625502B2 (en) | 2016-06-10 | 2023-04-11 | OneTrust, LLC | Data processing systems for identifying and modifying processes that are subject to data subject access requests |
US10284604B2 (en) | 2016-06-10 | 2019-05-07 | OneTrust, LLC | Data processing and scanning systems for generating and populating a data inventory |
US10592692B2 (en) | 2016-06-10 | 2020-03-17 | OneTrust, LLC | Data processing systems for central consent repository and related methods |
US10853501B2 (en) | 2016-06-10 | 2020-12-01 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US11636171B2 (en) | 2016-06-10 | 2023-04-25 | OneTrust, LLC | Data processing user interface monitoring systems and related methods |
US11392720B2 (en) | 2016-06-10 | 2022-07-19 | OneTrust, LLC | Data processing systems for verification of consent and notice processing and related methods |
US10565236B1 (en) | 2016-06-10 | 2020-02-18 | OneTrust, LLC | Data processing systems for generating and populating a data inventory |
US10944725B2 (en) | 2016-06-10 | 2021-03-09 | OneTrust, LLC | Data processing systems and methods for using a data model to select a target data asset in a data migration |
US11461500B2 (en) | 2016-06-10 | 2022-10-04 | OneTrust, LLC | Data processing systems for cookie compliance testing with website scanning and related methods |
US11087260B2 (en) | 2016-06-10 | 2021-08-10 | OneTrust, LLC | Data processing systems and methods for customizing privacy training |
US10318761B2 (en) | 2016-06-10 | 2019-06-11 | OneTrust, LLC | Data processing systems and methods for auditing data request compliance |
US11544667B2 (en) | 2016-06-10 | 2023-01-03 | OneTrust, LLC | Data processing systems for generating and populating a data inventory |
US11416590B2 (en) | 2016-06-10 | 2022-08-16 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US10796260B2 (en) | 2016-06-10 | 2020-10-06 | OneTrust, LLC | Privacy management systems and methods |
US10846433B2 (en) | 2016-06-10 | 2020-11-24 | OneTrust, LLC | Data processing consent management systems and related methods |
US11100444B2 (en) | 2016-06-10 | 2021-08-24 | OneTrust, LLC | Data processing systems and methods for providing training in a vendor procurement process |
US11336697B2 (en) | 2016-06-10 | 2022-05-17 | OneTrust, LLC | Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods |
US10909488B2 (en) | 2016-06-10 | 2021-02-02 | OneTrust, LLC | Data processing systems for assessing readiness for responding to privacy-related incidents |
US10885485B2 (en) | 2016-06-10 | 2021-01-05 | OneTrust, LLC | Privacy management systems and methods |
US11188862B2 (en) | 2016-06-10 | 2021-11-30 | OneTrust, LLC | Privacy management systems and methods |
US10997315B2 (en) | 2016-06-10 | 2021-05-04 | OneTrust, LLC | Data processing systems for fulfilling data subject access requests and related methods |
US10949565B2 (en) | 2016-06-10 | 2021-03-16 | OneTrust, LLC | Data processing systems for generating and populating a data inventory |
US11295316B2 (en) | 2016-06-10 | 2022-04-05 | OneTrust, LLC | Data processing systems for identity validation for consumer rights requests and related methods |
US10607028B2 (en) | 2016-06-10 | 2020-03-31 | OneTrust, LLC | Data processing systems for data testing to confirm data deletion and related methods |
US11057356B2 (en) | 2016-06-10 | 2021-07-06 | OneTrust, LLC | Automated data processing systems and methods for automatically processing data subject access requests using a chatbot |
US11200341B2 (en) | 2016-06-10 | 2021-12-14 | OneTrust, LLC | Consent receipt management systems and related methods |
US11222142B2 (en) | 2016-06-10 | 2022-01-11 | OneTrust, LLC | Data processing systems for validating authorization for personal data collection, storage, and processing |
US11438386B2 (en) | 2016-06-10 | 2022-09-06 | OneTrust, LLC | Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods |
US11418492B2 (en) | 2016-06-10 | 2022-08-16 | OneTrust, LLC | Data processing systems and methods for using a data model to select a target data asset in a data migration |
US11301796B2 (en) | 2016-06-10 | 2022-04-12 | OneTrust, LLC | Data processing systems and methods for customizing privacy training |
US11481710B2 (en) | 2016-06-10 | 2022-10-25 | OneTrust, LLC | Privacy management systems and methods |
US11074367B2 (en) | 2016-06-10 | 2021-07-27 | OneTrust, LLC | Data processing systems for identity validation for consumer rights requests and related methods |
US11341447B2 (en) | 2016-06-10 | 2022-05-24 | OneTrust, LLC | Privacy management systems and methods |
US11238390B2 (en) | 2016-06-10 | 2022-02-01 | OneTrust, LLC | Privacy management systems and methods |
US10169609B1 (en) | 2016-06-10 | 2019-01-01 | OneTrust, LLC | Data processing systems for fulfilling data subject access requests and related methods |
US11222139B2 (en) | 2016-06-10 | 2022-01-11 | OneTrust, LLC | Data processing systems and methods for automatic discovery and assessment of mobile software development kits |
US11144622B2 (en) | 2016-06-10 | 2021-10-12 | OneTrust, LLC | Privacy management systems and methods |
US11354434B2 (en) | 2016-06-10 | 2022-06-07 | OneTrust, LLC | Data processing systems for verification of consent and notice processing and related methods |
US11354435B2 (en) | 2016-06-10 | 2022-06-07 | OneTrust, LLC | Data processing systems for data testing to confirm data deletion and related methods |
US11343284B2 (en) | 2016-06-10 | 2022-05-24 | OneTrust, LLC | Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance |
US11138242B2 (en) | 2016-06-10 | 2021-10-05 | OneTrust, LLC | Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software |
US10803200B2 (en) * | 2016-06-10 | 2020-10-13 | OneTrust, LLC | Data processing systems for processing and managing data subject access in a distributed environment |
US11328092B2 (en) | 2016-06-10 | 2022-05-10 | OneTrust, LLC | Data processing systems for processing and managing data subject access in a distributed environment |
US10909265B2 (en) | 2016-06-10 | 2021-02-02 | OneTrust, LLC | Application privacy scanning systems and related methods |
US11151233B2 (en) | 2016-06-10 | 2021-10-19 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US11157600B2 (en) | 2016-06-10 | 2021-10-26 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US11134086B2 (en) | 2016-06-10 | 2021-09-28 | OneTrust, LLC | Consent conversion optimization systems and related methods |
US11727141B2 (en) | 2016-06-10 | 2023-08-15 | OneTrust, LLC | Data processing systems and methods for synching privacy-related user consent across multiple computing devices |
US11651104B2 (en) | 2016-06-10 | 2023-05-16 | OneTrust, LLC | Consent receipt management systems and related methods |
US11651106B2 (en) | 2016-06-10 | 2023-05-16 | OneTrust, LLC | Data processing systems for fulfilling data subject access requests and related methods |
US11222309B2 (en) | 2016-06-10 | 2022-01-11 | OneTrust, LLC | Data processing systems for generating and populating a data inventory |
US11416798B2 (en) | 2016-06-10 | 2022-08-16 | OneTrust, LLC | Data processing systems and methods for providing training in a vendor procurement process |
US10783256B2 (en) | 2016-06-10 | 2020-09-22 | OneTrust, LLC | Data processing systems for data transfer risk identification and related methods |
US11416109B2 (en) | 2016-06-10 | 2022-08-16 | OneTrust, LLC | Automated data processing systems and methods for automatically processing data subject access requests using a chatbot |
US11366909B2 (en) | 2016-06-10 | 2022-06-21 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US10467432B2 (en) | 2016-06-10 | 2019-11-05 | OneTrust, LLC | Data processing systems for use in automatically generating, populating, and submitting data subject access requests |
US11277448B2 (en) | 2016-06-10 | 2022-03-15 | OneTrust, LLC | Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods |
US10740487B2 (en) | 2016-06-10 | 2020-08-11 | OneTrust, LLC | Data processing systems and methods for populating and maintaining a centralized database of personal data |
US11025675B2 (en) | 2016-06-10 | 2021-06-01 | OneTrust, LLC | Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance |
US10839102B2 (en) | 2016-06-10 | 2020-11-17 | OneTrust, LLC | Data processing systems for identifying and modifying processes that are subject to data subject access requests |
US11227247B2 (en) | 2016-06-10 | 2022-01-18 | OneTrust, LLC | Data processing systems and methods for bundled privacy policies |
US10592648B2 (en) | 2016-06-10 | 2020-03-17 | OneTrust, LLC | Consent receipt management systems and related methods |
US11188615B2 (en) | 2016-06-10 | 2021-11-30 | OneTrust, LLC | Data processing consent capture systems and related methods |
US11138299B2 (en) | 2016-06-10 | 2021-10-05 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US11675929B2 (en) | 2016-06-10 | 2023-06-13 | OneTrust, LLC | Data processing consent sharing systems and related methods |
US11586700B2 (en) | 2016-06-10 | 2023-02-21 | OneTrust, LLC | Data processing systems and methods for automatically blocking the use of tracking tools |
US10878127B2 (en) | 2016-06-10 | 2020-12-29 | OneTrust, LLC | Data subject access request processing systems and related methods |
US10997318B2 (en) | 2016-06-10 | 2021-05-04 | OneTrust, LLC | Data processing systems for generating and populating a data inventory for processing data access requests |
US11228620B2 (en) | 2016-06-10 | 2022-01-18 | OneTrust, LLC | Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods |
US11562097B2 (en) | 2016-06-10 | 2023-01-24 | OneTrust, LLC | Data processing systems for central consent repository and related methods |
US11146566B2 (en) | 2016-06-10 | 2021-10-12 | OneTrust, LLC | Data processing systems for fulfilling data subject access requests and related methods |
US10282700B2 (en) | 2016-06-10 | 2019-05-07 | OneTrust, LLC | Data processing systems for generating and populating a data inventory |
US11416589B2 (en) | 2016-06-10 | 2022-08-16 | OneTrust, LLC | Data processing and scanning systems for assessing vendor risk |
US11023842B2 (en) | 2016-06-10 | 2021-06-01 | OneTrust, LLC | Data processing systems and methods for bundled privacy policies |
US10896394B2 (en) | 2016-06-10 | 2021-01-19 | OneTrust, LLC | Privacy management systems and methods |
US11038925B2 (en) | 2016-06-10 | 2021-06-15 | OneTrust, LLC | Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods |
US10503926B2 (en) | 2016-06-10 | 2019-12-10 | OneTrust, LLC | Consent receipt management systems and related methods |
US10678945B2 (en) | 2016-06-10 | 2020-06-09 | OneTrust, LLC | Consent receipt management systems and related methods |
US11294939B2 (en) | 2016-06-10 | 2022-04-05 | OneTrust, LLC | Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software |
US10606916B2 (en) | 2016-06-10 | 2020-03-31 | OneTrust, LLC | Data processing user interface monitoring systems and related methods |
US10282559B2 (en) | 2016-06-10 | 2019-05-07 | OneTrust, LLC | Data processing systems for identifying, assessing, and remediating data processing risks using data modeling techniques |
US10685140B2 (en) | 2016-06-10 | 2020-06-16 | OneTrust, LLC | Consent receipt management systems and related methods |
US11475136B2 (en) | 2016-06-10 | 2022-10-18 | OneTrust, LLC | Data processing systems for data transfer risk identification and related methods |
US11210420B2 (en) | 2016-06-10 | 2021-12-28 | OneTrust, LLC | Data subject access request processing systems and related methods |
US10565161B2 (en) | 2016-06-10 | 2020-02-18 | OneTrust, LLC | Data processing systems for processing data subject access requests |
US10169585B1 (en) | 2016-06-22 | 2019-01-01 | Fireeye, Inc. | System and methods for advanced malware detection through placement of transition events |
US10462173B1 (en) | 2016-06-30 | 2019-10-29 | Fireeye, Inc. | Malware detection verification and enhancement by coordinating endpoint and malware detection systems |
CN106330778B (en) * | 2016-08-22 | 2020-01-24 | 深圳广联赛讯有限公司 | Network flow control method and device |
US10592678B1 (en) | 2016-09-09 | 2020-03-17 | Fireeye, Inc. | Secure communications between peers using a verified virtual trusted platform module |
US10491627B1 (en) | 2016-09-29 | 2019-11-26 | Fireeye, Inc. | Advanced malware detection using similarity analysis |
TWI611308B (en) * | 2016-11-03 | 2018-01-11 | 財團法人資訊工業策進會 | Webpage data extraction device and webpage data extraction method thereof |
US10795991B1 (en) | 2016-11-08 | 2020-10-06 | Fireeye, Inc. | Enterprise search |
GB2555801A (en) * | 2016-11-09 | 2018-05-16 | F Secure Corp | Identifying fraudulent and malicious websites, domain and subdomain names |
US10587647B1 (en) | 2016-11-22 | 2020-03-10 | Fireeye, Inc. | Technique for malware detection capability comparison of network security devices |
US10552610B1 (en) | 2016-12-22 | 2020-02-04 | Fireeye, Inc. | Adaptive virtual machine snapshot update framework for malware behavioral analysis |
US10581879B1 (en) | 2016-12-22 | 2020-03-03 | Fireeye, Inc. | Enhanced malware detection for generated objects |
US10523609B1 (en) | 2016-12-27 | 2019-12-31 | Fireeye, Inc. | Multi-vector malware detection and analysis |
US10904286B1 (en) | 2017-03-24 | 2021-01-26 | Fireeye, Inc. | Detection of phishing attacks using similarity analysis |
US10554507B1 (en) | 2017-03-30 | 2020-02-04 | Fireeye, Inc. | Multi-level control for enhanced resource and object evaluation management of malware detection system |
US10902119B1 (en) | 2017-03-30 | 2021-01-26 | Fireeye, Inc. | Data extraction system for malware analysis |
US10798112B2 (en) | 2017-03-30 | 2020-10-06 | Fireeye, Inc. | Attribute-controlled malware detection |
US10791138B1 (en) | 2017-03-30 | 2020-09-29 | Fireeye, Inc. | Subscription-based malware detection |
US10013577B1 (en) | 2017-06-16 | 2018-07-03 | OneTrust, LLC | Data processing systems for identifying whether cookies contain personally identifying information |
US10601848B1 (en) | 2017-06-29 | 2020-03-24 | Fireeye, Inc. | Cyber-security system and method for weak indicator detection and correlation to generate strong indicators |
US10503904B1 (en) | 2017-06-29 | 2019-12-10 | Fireeye, Inc. | Ransomware detection and mitigation |
US10855700B1 (en) | 2017-06-29 | 2020-12-01 | Fireeye, Inc. | Post-intrusion detection of cyber-attacks during lateral movement within networks |
US10893068B1 (en) | 2017-06-30 | 2021-01-12 | Fireeye, Inc. | Ransomware file modification prevention technique |
CN107454083A (en) * | 2017-08-08 | 2017-12-08 | 四川长虹电器股份有限公司 | The method of anti-reptile |
US10747872B1 (en) | 2017-09-27 | 2020-08-18 | Fireeye, Inc. | System and method for preventing malware evasion |
US10805346B2 (en) | 2017-10-01 | 2020-10-13 | Fireeye, Inc. | Phishing attack detection |
US11108809B2 (en) | 2017-10-27 | 2021-08-31 | Fireeye, Inc. | System and method for analyzing binary code for malware classification using artificial neural network techniques |
US11240275B1 (en) | 2017-12-28 | 2022-02-01 | Fireeye Security Holdings Us Llc | Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture |
US11271955B2 (en) | 2017-12-28 | 2022-03-08 | Fireeye Security Holdings Us Llc | Platform and method for retroactive reclassification employing a cybersecurity-based global data store |
US11005860B1 (en) | 2017-12-28 | 2021-05-11 | Fireeye, Inc. | Method and system for efficient cybersecurity analysis of endpoint events |
US10826931B1 (en) | 2018-03-29 | 2020-11-03 | Fireeye, Inc. | System and method for predicting and mitigating cybersecurity system misconfigurations |
US10956477B1 (en) | 2018-03-30 | 2021-03-23 | Fireeye, Inc. | System and method for detecting malicious scripts through natural language processing modeling |
US11558401B1 (en) | 2018-03-30 | 2023-01-17 | Fireeye Security Holdings Us Llc | Multi-vector malware detection data sharing system for improved detection |
US11003773B1 (en) | 2018-03-30 | 2021-05-11 | Fireeye, Inc. | System and method for automatically generating malware detection rule recommendations |
US11314859B1 (en) | 2018-06-27 | 2022-04-26 | FireEye Security Holdings, Inc. | Cyber-security system and method for detecting escalation of privileges within an access token |
US11075930B1 (en) | 2018-06-27 | 2021-07-27 | Fireeye, Inc. | System and method for detecting repetitive cybersecurity attacks constituting an email campaign |
US11201875B2 (en) * | 2018-06-28 | 2021-12-14 | Webroot, Inc. | Web threat investigation using advanced web crawling |
US11228491B1 (en) | 2018-06-28 | 2022-01-18 | Fireeye Security Holdings Us Llc | System and method for distributed cluster configuration monitoring and management |
US11316900B1 (en) | 2018-06-29 | 2022-04-26 | FireEye Security Holdings Inc. | System and method for automatically prioritizing rules for cyber-threat detection and mitigation |
US11544409B2 (en) | 2018-09-07 | 2023-01-03 | OneTrust, LLC | Data processing systems and methods for automatically protecting sensitive data within privacy management systems |
US10803202B2 (en) | 2018-09-07 | 2020-10-13 | OneTrust, LLC | Data processing systems for orphaned data identification and deletion and related methods |
US11144675B2 (en) | 2018-09-07 | 2021-10-12 | OneTrust, LLC | Data processing systems and methods for automatically protecting sensitive data within privacy management systems |
US11182473B1 (en) | 2018-09-13 | 2021-11-23 | Fireeye Security Holdings Us Llc | System and method for mitigating cyberattacks against processor operability by a guest process |
CN109670093A (en) * | 2018-09-26 | 2019-04-23 | 深圳壹账通智能科技有限公司 | Crawler recognition methods, device, equipment and readable storage medium storing program for executing |
US11763004B1 (en) | 2018-09-27 | 2023-09-19 | Fireeye Security Holdings Us Llc | System and method for bootkit detection |
US11176251B1 (en) | 2018-12-21 | 2021-11-16 | Fireeye, Inc. | Determining malware via symbolic function hash analysis |
US11743290B2 (en) | 2018-12-21 | 2023-08-29 | Fireeye Security Holdings Us Llc | System and method for detecting cyberattacks impersonating legitimate sources |
US11368475B1 (en) | 2018-12-21 | 2022-06-21 | Fireeye Security Holdings Us Llc | System and method for scanning remote services to locate stored objects with malware |
US11601444B1 (en) | 2018-12-31 | 2023-03-07 | Fireeye Security Holdings Us Llc | Automated system for triage of customer issues |
US11310238B1 (en) | 2019-03-26 | 2022-04-19 | FireEye Security Holdings, Inc. | System and method for retrieval and analysis of operational data from customer, cloud-hosted virtual resources |
US11677786B1 (en) | 2019-03-29 | 2023-06-13 | Fireeye Security Holdings Us Llc | System and method for detecting and protecting against cybersecurity attacks on servers |
US11636198B1 (en) | 2019-03-30 | 2023-04-25 | Fireeye Security Holdings Us Llc | System and method for cybersecurity analyzer update and concurrent management system |
US11258806B1 (en) | 2019-06-24 | 2022-02-22 | Mandiant, Inc. | System and method for automatically associating cybersecurity intelligence to cyberthreat actors |
US11556640B1 (en) | 2019-06-27 | 2023-01-17 | Mandiant, Inc. | Systems and methods for automated cybersecurity analysis of extracted binary string sets |
US11392700B1 (en) | 2019-06-28 | 2022-07-19 | Fireeye Security Holdings Us Llc | System and method for supporting cross-platform data verification |
CN110519280B (en) * | 2019-08-30 | 2022-01-04 | 北京思维造物信息科技股份有限公司 | Crawler identification method and device, computer equipment and storage medium |
US11886585B1 (en) | 2019-09-27 | 2024-01-30 | Musarubra Us Llc | System and method for identifying and mitigating cyberattacks through malicious position-independent code execution |
US11637862B1 (en) | 2019-09-30 | 2023-04-25 | Mandiant, Inc. | System and method for surfacing cyber-security threats with a self-learning recommendation engine |
US11522884B1 (en) | 2019-12-24 | 2022-12-06 | Fireeye Security Holdings Us Llc | Subscription and key management system |
US11436327B1 (en) | 2019-12-24 | 2022-09-06 | Fireeye Security Holdings Us Llc | System and method for circumventing evasive code for cyberthreat detection |
US11838300B1 (en) | 2019-12-24 | 2023-12-05 | Musarubra Us Llc | Run-time configurable cybersecurity system |
EP4179435A1 (en) | 2020-07-08 | 2023-05-17 | OneTrust LLC | Systems and methods for targeted data discovery |
WO2022026564A1 (en) | 2020-07-28 | 2022-02-03 | OneTrust, LLC | Systems and methods for automatically blocking the use of tracking tools |
US11475165B2 (en) | 2020-08-06 | 2022-10-18 | OneTrust, LLC | Data processing systems and methods for automatically redacting unstructured data from a data subject access request |
CN112134852B (en) * | 2020-08-31 | 2021-08-13 | 广州锦行网络科技有限公司 | Honeypot system attack behavior data asynchronous http sending method and device |
WO2022060860A1 (en) | 2020-09-15 | 2022-03-24 | OneTrust, LLC | Data processing systems and methods for detecting tools for the automatic blocking of consent requests |
WO2022061270A1 (en) | 2020-09-21 | 2022-03-24 | OneTrust, LLC | Data processing systems and methods for automatically detecting target data transfers and target data processing |
US11397819B2 (en) | 2020-11-06 | 2022-07-26 | OneTrust, LLC | Systems and methods for identifying data processing activities based on data discovery results |
CN114650158A (en) * | 2020-12-21 | 2022-06-21 | 深信服科技股份有限公司 | HTTP detection method, system, equipment and computer storage medium |
WO2022159901A1 (en) | 2021-01-25 | 2022-07-28 | OneTrust, LLC | Systems and methods for discovery, classification, and indexing of data in a native computing system |
US11442906B2 (en) | 2021-02-04 | 2022-09-13 | OneTrust, LLC | Managing custom attributes for domain objects defined within microservices |
WO2022170254A1 (en) | 2021-02-08 | 2022-08-11 | OneTrust, LLC | Data processing systems and methods for anonymizing data samples in classification analysis |
US11601464B2 (en) | 2021-02-10 | 2023-03-07 | OneTrust, LLC | Systems and methods for mitigating risks of third-party computing system functionality integration into a first-party computing system |
US11775348B2 (en) | 2021-02-17 | 2023-10-03 | OneTrust, LLC | Managing custom workflows for domain objects defined within microservices |
WO2022178219A1 (en) | 2021-02-18 | 2022-08-25 | OneTrust, LLC | Selective redaction of media content |
EP4305539A1 (en) | 2021-03-08 | 2024-01-17 | OneTrust, LLC | Data transfer discovery and analysis systems and related methods |
US11562078B2 (en) | 2021-04-16 | 2023-01-24 | OneTrust, LLC | Assessing and managing computational risk involved with integrating third party computing functionality within a computing system |
US11620142B1 (en) | 2022-06-03 | 2023-04-04 | OneTrust, LLC | Generating and customizing user interfaces for demonstrating functions of interactive user environments |
US11706226B1 (en) * | 2022-06-21 | 2023-07-18 | Uab 360 It | Systems and methods for controlling access to domains using artificial intelligence |
Citations (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030009495A1 (en) * | 2001-06-29 | 2003-01-09 | Akli Adjaoute | Systems and methods for filtering electronic content |
US20040128285A1 (en) * | 2000-12-15 | 2004-07-01 | Jacob Green | Dynamic-content web crawling through traffic monitoring |
US20040172389A1 (en) * | 2001-07-27 | 2004-09-02 | Yaron Galai | System and method for automated tracking and analysis of document usage |
US6839680B1 (en) * | 1999-09-30 | 2005-01-04 | Fujitsu Limited | Internet profiling |
US20060075494A1 (en) * | 2004-10-01 | 2006-04-06 | Bertman Justin R | Method and system for analyzing data for potential malware |
US20060075500A1 (en) * | 2004-10-01 | 2006-04-06 | Bertman Justin R | System and method for locating malware |
US20070294352A1 (en) * | 2004-05-02 | 2007-12-20 | Markmonitor, Inc. | Generating phish messages |
US20080082662A1 (en) * | 2006-05-19 | 2008-04-03 | Richard Dandliker | Method and apparatus for controlling access to network resources based on reputation |
US20090138573A1 (en) * | 2005-04-22 | 2009-05-28 | Alexander Wade Campbell | Methods and apparatus for blocking unwanted software downloads |
USRE41168E1 (en) * | 1998-03-31 | 2010-03-23 | Content Advisor, Inc. | Controlling client access to networked data based on content subject matter categorization |
US8015250B2 (en) * | 2005-06-22 | 2011-09-06 | Websense Hosted R&D Limited | Method and system for filtering electronic messages |
US20110314546A1 (en) * | 2004-04-01 | 2011-12-22 | Ashar Aziz | Electronic Message Analysis for Malware Detection |
Family Cites Families (363)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4423414A (en) | 1981-08-27 | 1983-12-27 | Burroughs Corporation | System and method for name-lookup in a local area network data communication system |
JPS6170654A (en) | 1984-09-14 | 1986-04-11 | Hitachi Ltd | Resource control system of decentralized processing system |
US4734036A (en) * | 1984-11-30 | 1988-03-29 | Helene Kasha | Method and device for learning a language |
JPH04127370A (en) | 1990-09-19 | 1992-04-28 | Toshiba Corp | Information collecting system |
US5758152A (en) * | 1990-12-06 | 1998-05-26 | Prime Arithmetics, Inc. | Method and apparatus for the generation and manipulation of data structures |
WO1992019054A1 (en) | 1991-04-12 | 1992-10-29 | Concord Communications, Inc. | Network monitoring |
US5408642A (en) * | 1991-05-24 | 1995-04-18 | Symantec Corporation | Method for recovery of a computer program infected by a computer virus |
JPH04372037A (en) | 1991-06-21 | 1992-12-25 | Matsushita Electric Ind Co Ltd | System management information setting device |
US5699287A (en) * | 1992-09-30 | 1997-12-16 | Texas Instruments Incorporated | Method and device for adding and subtracting thermometer coded data |
US5581703A (en) | 1993-06-29 | 1996-12-03 | International Business Machines Corporation | Method and apparatus for reserving system resources to assure quality of service |
US5493692A (en) * | 1993-12-03 | 1996-02-20 | Xerox Corporation | Selective delivery of electronic messages in a multiple computer system based on context and environment of a user |
US5555376A (en) | 1993-12-03 | 1996-09-10 | Xerox Corporation | Method for granting a user request having locational and contextual attributes consistent with user policies for devices having locational attributes consistent with the user request |
US5606668A (en) * | 1993-12-15 | 1997-02-25 | Checkpoint Software Technologies Ltd. | System for securing inbound and outbound data packet flow in a computer network |
US5835726A (en) | 1993-12-15 | 1998-11-10 | Check Point Software Technologies Ltd. | System for securing the flow of and selectively modifying packets in a computer network |
US6769009B1 (en) | 1994-05-31 | 2004-07-27 | Richard R. Reisman | Method and system for selecting a personalized set of information channels |
US5720033A (en) * | 1994-06-30 | 1998-02-17 | Lucent Technologies Inc. | Security platform and method using object oriented rules for computer-based systems using UNIX-line operating systems |
WO1996005549A1 (en) | 1994-08-09 | 1996-02-22 | Shiva Corporation | Apparatus and method for restricting access to a local computer network |
US5682325A (en) | 1994-09-12 | 1997-10-28 | Bell Atlantic Network Services, Inc. | Level 1 gateway for video tone networks |
US5944794A (en) | 1994-09-30 | 1999-08-31 | Kabushiki Kaisha Toshiba | User identification data management scheme for networking computer systems using wide area network |
US5864683A (en) * | 1994-10-12 | 1999-01-26 | Secure Computing Corporartion | System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights |
US5541911A (en) | 1994-10-12 | 1996-07-30 | 3Com Corporation | Remote smart filtering communication management system |
US5758257A (en) * | 1994-11-29 | 1998-05-26 | Herz; Frederick | System and method for scheduling broadcast of and access to video programs and other data using customer profiles |
US5832503A (en) | 1995-02-24 | 1998-11-03 | Cabletron Systems, Inc. | Method and apparatus for configuration management in communications networks |
US5696486A (en) | 1995-03-29 | 1997-12-09 | Cabletron Systems, Inc. | Method and apparatus for policy-based alarm notification in a distributed network management environment |
US5699513A (en) | 1995-03-31 | 1997-12-16 | Motorola, Inc. | Method for secure network access via message intercept |
US5586121A (en) | 1995-04-21 | 1996-12-17 | Hybrid Networks, Inc. | Asymmetric hybrid access system and method |
DE19681387B4 (en) * | 1995-05-08 | 2004-12-09 | Compuserve Inc., Columbus | Rule-based electronic messaging management system |
US5802278A (en) | 1995-05-10 | 1998-09-01 | 3Com Corporation | Bridge/router architecture for high performance scalable networking |
US5696898A (en) | 1995-06-06 | 1997-12-09 | Lucent Technologies Inc. | System and method for database access control |
CA2176775C (en) | 1995-06-06 | 1999-08-03 | Brenda Sue Baker | System and method for database access administration |
US5678041A (en) | 1995-06-06 | 1997-10-14 | At&T | System and method for restricting user access rights on the internet based on rating information stored in a relational database |
US5774668A (en) | 1995-06-07 | 1998-06-30 | Microsoft Corporation | System for on-line service in which gateway computer uses service map which includes loading condition of servers broadcasted by application servers for load balancing |
WO1996042041A2 (en) | 1995-06-07 | 1996-12-27 | Open Market, Inc. | Internet server access control and monitoring systems |
US6456306B1 (en) | 1995-06-08 | 2002-09-24 | Nortel Networks Limited | Method and apparatus for displaying health status of network devices |
US6807558B1 (en) | 1995-06-12 | 2004-10-19 | Pointcast, Inc. | Utilization of information “push” technology |
US5706507A (en) * | 1995-07-05 | 1998-01-06 | International Business Machines Corporation | System and method for controlling access to data located on a content server |
US5648965A (en) | 1995-07-07 | 1997-07-15 | Sun Microsystems, Inc. | Method and apparatus for dynamic distributed packet tracing and analysis |
US5796944A (en) | 1995-07-12 | 1998-08-18 | 3Com Corporation | Apparatus and method for processing data frames in an internetworking device |
US5742759A (en) * | 1995-08-18 | 1998-04-21 | Sun Microsystems, Inc. | Method and system for facilitating access control to system resources in a distributed computer system |
US5941947A (en) | 1995-08-18 | 1999-08-24 | Microsoft Corporation | System and method for controlling access to data entities in a computer network |
US5712979A (en) * | 1995-09-20 | 1998-01-27 | Infonautics Corporation | Method and apparatus for attaching navigational history information to universal resource locator links on a world wide web page |
US6338088B1 (en) * | 1995-11-02 | 2002-01-08 | British Telecommunications Public Limited Company | Service creation apparatus for a communications network |
US5781801A (en) | 1995-12-20 | 1998-07-14 | Emc Corporation | Method and apparatus for receive buffer management in multi-sender communication systems |
WO1997024665A1 (en) | 1995-12-28 | 1997-07-10 | Eyal Dotan | Method for protecting executable software programs against infection by software viruses |
US5787427A (en) | 1996-01-03 | 1998-07-28 | International Business Machines Corporation | Information handling system, method, and article of manufacture for efficient object security processing by grouping objects sharing common control access policies |
US5768519A (en) | 1996-01-18 | 1998-06-16 | Microsoft Corporation | Method and apparatus for merging user accounts from a source security domain into a target security domain |
US5898830A (en) * | 1996-10-17 | 1999-04-27 | Network Engineering Software | Firewall providing enhanced network security and user transparency |
US5826014A (en) | 1996-02-06 | 1998-10-20 | Network Engineering Software | Firewall system for protecting network elements connected to a public network |
US5855020A (en) | 1996-02-21 | 1998-12-29 | Infoseek Corporation | Web scan process |
US5832212A (en) | 1996-04-19 | 1998-11-03 | International Business Machines Corporation | Censoring browser method and apparatus for internet viewing |
US5884033A (en) * | 1996-05-15 | 1999-03-16 | Spyglass, Inc. | Internet filtering system for filtering data transferred over the internet utilizing immediate and deferred filtering actions |
US5787253A (en) | 1996-05-28 | 1998-07-28 | The Ag Group | Apparatus and method of analyzing internet activity |
US5920859A (en) | 1997-02-05 | 1999-07-06 | Idd Enterprises, L.P. | Hypertext document retrieval system and method |
US5842040A (en) | 1996-06-18 | 1998-11-24 | Storage Technology Corporation | Policy caching method and apparatus for use in a communication device based on contents of one data unit in a subset of related data units |
US5850523A (en) | 1996-06-21 | 1998-12-15 | National Instruments Corporation | Method and system for monitoring fieldbus network with multiple packet filters |
US5991807A (en) | 1996-06-24 | 1999-11-23 | Nortel Networks Corporation | System for controlling users access to a distributive network in accordance with constraints present in common access distributive network interface separate from a server |
US5835722A (en) * | 1996-06-27 | 1998-11-10 | Logon Data Corporation | System to control content and prohibit certain interactive attempts by a person using a personal computer |
US5799002A (en) | 1996-07-02 | 1998-08-25 | Microsoft Corporation | Adaptive bandwidth throttling for network services |
US6052723A (en) * | 1996-07-25 | 2000-04-18 | Stockmaster.Com, Inc. | Method for aggregate control on an electronic network |
US5832228A (en) | 1996-07-30 | 1998-11-03 | Itt Industries, Inc. | System and method for providing multi-level security in computer devices utilized with non-secure networks |
EP0822502A1 (en) * | 1996-07-31 | 1998-02-04 | BRITISH TELECOMMUNICATIONS public limited company | Data access system |
US5828833A (en) | 1996-08-15 | 1998-10-27 | Electronic Data Systems Corporation | Method and system for allowing remote procedure calls through a network firewall |
US5950195A (en) | 1996-09-18 | 1999-09-07 | Secure Computing Corporation | Generalized security policy management system and method |
US6253188B1 (en) | 1996-09-20 | 2001-06-26 | Thomson Newspapers, Inc. | Automated interactive classified ad system for the internet |
US5933827A (en) | 1996-09-25 | 1999-08-03 | International Business Machines Corporation | System for identifying new web pages of interest to a user |
US5911043A (en) | 1996-10-01 | 1999-06-08 | Baker & Botts, L.L.P. | System and method for computer-based rating of information retrieved from a computer network |
US5884325A (en) * | 1996-10-09 | 1999-03-16 | Oracle Corporation | System for synchronizing shared data between computers |
US5958015A (en) | 1996-10-29 | 1999-09-28 | Abirnet Ltd. | Network session wall passively listening to communication session, with use of access rules, stops further communication between network devices by emulating messages to the devices |
US6167520A (en) | 1996-11-08 | 2000-12-26 | Finjan Software, Inc. | System and method for protecting a client during runtime from hostile downloadables |
US7058822B2 (en) | 2000-03-30 | 2006-06-06 | Finjan Software, Ltd. | Malicious mobile code runtime monitoring system and methods |
US5801747A (en) | 1996-11-15 | 1998-09-01 | Hyundai Electronics America | Method and apparatus for creating a television viewer profile |
US5848412A (en) | 1996-11-19 | 1998-12-08 | Ncr Corporation | User controlled browser identification disclosing mechanism |
US5848233A (en) | 1996-12-09 | 1998-12-08 | Sun Microsystems, Inc. | Method and apparatus for dynamic packet filter assignment |
US6078914A (en) | 1996-12-09 | 2000-06-20 | Open Text Corporation | Natural language meta-search system and method |
US6070242A (en) * | 1996-12-09 | 2000-05-30 | Sun Microsystems, Inc. | Method to activate unregistered systems in a distributed multiserver network environment |
US5896502A (en) * | 1996-12-10 | 1999-04-20 | International Business Machines Corporation | Internet data transfer control via a client system to reduce delay |
US6065059A (en) * | 1996-12-10 | 2000-05-16 | International Business Machines Corporation | Filtered utilization of internet data transfers to reduce delay and increase user control |
US5889958A (en) | 1996-12-20 | 1999-03-30 | Livingston Enterprises, Inc. | Network access control system and process |
US5892905A (en) * | 1996-12-23 | 1999-04-06 | International Business Machines Corporation | Computer apparatus and method for providing a common user interface for software applications accessed via the world-wide web |
US6832256B1 (en) | 1996-12-27 | 2004-12-14 | Intel Corporation | Firewalls that filter based upon protocol commands |
US5987611A (en) | 1996-12-31 | 1999-11-16 | Zone Labs, Inc. | System and methodology for managing internet access on a per application basis for client computers connected to the internet |
US6052730A (en) * | 1997-01-10 | 2000-04-18 | The Board Of Trustees Of The Leland Stanford Junior University | Method for monitoring and/or modifying web browsing sessions |
US6173364B1 (en) * | 1997-01-15 | 2001-01-09 | At&T Corp. | Session cache and rule caching method for a dynamic filter |
US6233686B1 (en) * | 1997-01-17 | 2001-05-15 | At & T Corp. | System and method for providing peer level access control on a network |
EP1486891A3 (en) | 1997-02-12 | 2005-03-09 | Kokusai Denshin Denwa Co., Ltd | Document retrieval apparatus |
AUPO525497A0 (en) | 1997-02-21 | 1997-03-20 | Mills, Dudley John | Network-based classified information systems |
JP3466039B2 (en) | 1997-02-26 | 2003-11-10 | 株式会社東芝 | Communication device and communication method |
US6076051A (en) | 1997-03-07 | 2000-06-13 | Microsoft Corporation | Information retrieval utilizing semantic representation of text |
US6178505B1 (en) * | 1997-03-10 | 2001-01-23 | Internet Dynamics, Inc. | Secure delivery of information in a network |
US6105027A (en) | 1997-03-10 | 2000-08-15 | Internet Dynamics, Inc. | Techniques for eliminating redundant access checking by access filters |
US5983270A (en) | 1997-03-11 | 1999-11-09 | Sequel Technology Corporation | Method and apparatus for managing internetwork and intranetwork activity |
US5987606A (en) | 1997-03-19 | 1999-11-16 | Bascom Global Internet Services, Inc. | Method and system for content filtering information retrieved from an internet computer network |
US5996011A (en) | 1997-03-25 | 1999-11-30 | Unified Research Laboratories, Inc. | System and method for filtering data received by a computer system |
US6539430B1 (en) | 1997-03-25 | 2003-03-25 | Symantec Corporation | System and method for filtering data received by a computer system |
US5937404A (en) | 1997-04-23 | 1999-08-10 | Appaloosa Interactive Corporation | Apparatus for bleaching a de-activated link in a web page of any distinguishing color or feature representing an active link |
US5961591A (en) | 1997-05-13 | 1999-10-05 | Microsoft Corporation | Downloading data while rejection of its use may be overridden |
US5968176A (en) | 1997-05-29 | 1999-10-19 | 3Com Corporation | Multilayer firewall system |
US5899995A (en) * | 1997-06-30 | 1999-05-04 | Intel Corporation | Method and apparatus for automatically organizing information |
US5956734A (en) | 1997-07-11 | 1999-09-21 | International Business Machines Corporation | Parallel file system with a quota check utility |
US5893086A (en) | 1997-07-11 | 1999-04-06 | International Business Machines Corporation | Parallel file system and method with extensible hashing |
US7117358B2 (en) | 1997-07-24 | 2006-10-03 | Tumbleweed Communications Corp. | Method and system for filtering communication |
US6356864B1 (en) | 1997-07-25 | 2002-03-12 | University Technology Corporation | Methods for analysis and evaluation of the semantic content of a writing based on vector length |
US6446119B1 (en) | 1997-08-07 | 2002-09-03 | Laslo Olah | System and method for monitoring computer usage |
US6275938B1 (en) * | 1997-08-28 | 2001-08-14 | Microsoft Corporation | Security enhancement for untrusted executable code |
AU737633B2 (en) * | 1997-09-02 | 2001-08-23 | Damon C. Torres | Automated content scheduler and displayer |
US5999929A (en) | 1997-09-29 | 1999-12-07 | Continuum Software, Inc | World wide web link referral system and method for generating and providing related links for links identified in web pages |
US5978807A (en) | 1997-09-30 | 1999-11-02 | Sony Corporation | Apparatus for and method of automatically downloading and storing internet web pages |
US6266664B1 (en) | 1997-10-01 | 2001-07-24 | Rulespace, Inc. | Method for scanning, analyzing and rating digital information content |
US6256739B1 (en) | 1997-10-30 | 2001-07-03 | Juno Online Services, Inc. | Method and apparatus to determine user identity and limit access to a communications network |
US6108799A (en) * | 1997-11-21 | 2000-08-22 | International Business Machines Corporation | Automated sample creation of polymorphic and non-polymorphic marcro viruses |
US5987457A (en) | 1997-11-25 | 1999-11-16 | Acceleration Software International Corporation | Query refinement method for searching documents |
JPH11219363A (en) | 1998-01-30 | 1999-08-10 | Toshiba Corp | Retrieval supporting system for data base |
US5987610A (en) * | 1998-02-12 | 1999-11-16 | Ameritech Corporation | Computer virus screening methods and systems |
US6357010B1 (en) * | 1998-02-17 | 2002-03-12 | Secure Computing Corporation | System and method for controlling access to documents stored on an internal network |
US6073135A (en) | 1998-03-10 | 2000-06-06 | Alta Vista Company | Connectivity server for locating linkage information between Web pages |
US6055564A (en) * | 1998-03-11 | 2000-04-25 | Hewlett Packard Company | Admission control where priority indicator is used to discriminate between messages |
US7302402B2 (en) * | 1998-03-30 | 2007-11-27 | International Business Machines Corporation | Method, system and program products for sharing state information across domains |
US6065055A (en) | 1998-04-20 | 2000-05-16 | Hughes; Patrick Alan | Inappropriate site management software |
US6219667B1 (en) * | 1998-05-28 | 2001-04-17 | International Business Machines Corporation | Efficient large-scale access control for internet/intranet information systems |
JP3665480B2 (en) | 1998-06-24 | 2005-06-29 | 富士通株式会社 | Document organizing apparatus and method |
US6742003B2 (en) * | 2001-04-30 | 2004-05-25 | Microsoft Corporation | Apparatus and accompanying methods for visualizing clusters of data and hierarchical cluster classifications |
US6377577B1 (en) * | 1998-06-30 | 2002-04-23 | Cisco Technology, Inc. | Access control list processing in hardware |
US6085241A (en) | 1998-07-22 | 2000-07-04 | Amplify. Net, Inc. | Internet user-bandwidth management and control tool |
US6446061B1 (en) | 1998-07-31 | 2002-09-03 | International Business Machines Corporation | Taxonomy generation for document collections |
US6266668B1 (en) | 1998-08-04 | 2001-07-24 | Dryken Technologies, Inc. | System and method for dynamic data-mining and on-line communication of customized information |
US6567800B1 (en) * | 1998-10-01 | 2003-05-20 | At&T Corp. | System and method for searching information stored on a network |
US6907425B1 (en) | 1998-10-01 | 2005-06-14 | At&T Corp. | System and method for searching information stored on a network |
US6460141B1 (en) | 1998-10-28 | 2002-10-01 | Rsa Security Inc. | Security and access management system for web-enabled and non-web-enabled applications and content on a computer network |
US7603685B2 (en) | 1998-11-03 | 2009-10-13 | United Video Properties, Inc. | Program guide system with combination category search |
WO2000033160A2 (en) * | 1998-12-03 | 2000-06-08 | Expanse Networks, Inc. | Subscriber characterization and advertisement monitoring system |
US7194554B1 (en) | 1998-12-08 | 2007-03-20 | Nomadix, Inc. | Systems and methods for providing dynamic network authorization authentication and accounting |
US6564327B1 (en) | 1998-12-23 | 2003-05-13 | Worldcom, Inc. | Method of and system for controlling internet access |
US6295529B1 (en) | 1998-12-24 | 2001-09-25 | Microsoft Corporation | Method and apparatus for indentifying clauses having predetermined characteristics indicative of usefulness in determining relationships between different texts |
US6654787B1 (en) | 1998-12-31 | 2003-11-25 | Brightmail, Incorporated | Method and apparatus for filtering e-mail |
US6654735B1 (en) | 1999-01-08 | 2003-11-25 | International Business Machines Corporation | Outbound information analysis for generating user interest profiles and improving user productivity |
US6418433B1 (en) | 1999-01-28 | 2002-07-09 | International Business Machines Corporation | System and method for focussed web crawling |
US6154741A (en) | 1999-01-29 | 2000-11-28 | Feldman; Daniel J. | Entitlement management and access control system |
JP3220104B2 (en) | 1999-02-16 | 2001-10-22 | ケイディーディーアイ株式会社 | Automatic information filtering method and apparatus using URL hierarchical structure |
US6286001B1 (en) | 1999-02-24 | 2001-09-04 | Doodlebug Online, Inc. | System and method for authorizing access to data on content servers in a distributed network |
US6366298B1 (en) | 1999-06-03 | 2002-04-02 | Netzero, Inc. | Monitoring of individual internet usage |
US6904609B1 (en) | 1999-03-18 | 2005-06-07 | Microsoft Corporation | Systems and methods for electronic program guide data services |
US20010044800A1 (en) | 2000-02-22 | 2001-11-22 | Sherwin Han | Internet organizer |
US6486892B1 (en) | 1999-04-07 | 2002-11-26 | Joseph L. Stern | System and method for accessing, manipulating and viewing internet and non-internet related information and for controlling networked devices |
US6175830B1 (en) | 1999-05-20 | 2001-01-16 | Evresearch, Ltd. | Information management, retrieval and display system and associated method |
US6519571B1 (en) * | 1999-05-27 | 2003-02-11 | Accenture Llp | Dynamic customer profile management |
US6493744B1 (en) | 1999-08-16 | 2002-12-10 | International Business Machines Corporation | Automatic rating and filtering of data files for objectionable content |
US6295559B1 (en) | 1999-08-26 | 2001-09-25 | International Business Machines Corporation | Rating hypermedia for objectionable content |
US6862713B1 (en) | 1999-08-31 | 2005-03-01 | International Business Machines Corporation | Interactive process for recognition and evaluation of a partial search query and display of interactive results |
US6675169B1 (en) | 1999-09-07 | 2004-01-06 | Microsoft Corporation | Method and system for attaching information to words of a trie |
US6745367B1 (en) | 1999-09-27 | 2004-06-01 | International Business Machines Corporation | Method and computer program product for implementing parental supervision for internet browsing |
US6792458B1 (en) * | 1999-10-04 | 2004-09-14 | Urchin Software Corporation | System and method for monitoring and analyzing internet traffic |
US6516337B1 (en) | 1999-10-14 | 2003-02-04 | Arcessa, Inc. | Sending to a central indexing site meta data or signatures from objects on a computer network |
US6434662B1 (en) | 1999-11-02 | 2002-08-13 | Juniper Networks, Inc. | System and method for searching an associative memory utilizing first and second hash functions |
AU1970001A (en) | 1999-11-05 | 2001-05-14 | Surfmonkey.Com, Inc. | System and method of filtering adult content on the internet |
US6954783B1 (en) | 1999-11-12 | 2005-10-11 | Bmc Software, Inc. | System and method of mediating a web page |
JP4279427B2 (en) | 1999-11-22 | 2009-06-17 | 富士通株式会社 | Communication support method and system |
US20020049883A1 (en) * | 1999-11-29 | 2002-04-25 | Eric Schneider | System and method for restoring a computer system after a failure |
US20020069368A1 (en) | 1999-12-07 | 2002-06-06 | Keith Hines | Data farming of network access |
US6832230B1 (en) | 1999-12-22 | 2004-12-14 | Nokia Corporation | Apparatus and associated method for downloading an application with a variable lifetime to a mobile terminal |
US6574660B1 (en) | 1999-12-28 | 2003-06-03 | Intel Corporation | Intelligent content delivery system based on user actions with client application data |
US6606659B1 (en) | 2000-01-28 | 2003-08-12 | Websense, Inc. | System and method for controlling access to internet sites |
EP1256064B1 (en) | 2000-01-28 | 2008-10-15 | Websense Inc. | System and method for controlling access to internet sites |
WO2001055905A1 (en) | 2000-01-28 | 2001-08-02 | Websense, Inc. | Automated categorization of internet data |
US7185361B1 (en) * | 2000-01-31 | 2007-02-27 | Secure Computing Corporation | System, method and computer program product for authenticating users using a lightweight directory access protocol (LDAP) directory server |
EP1122929A1 (en) * | 2000-02-07 | 2001-08-08 | TELEFONAKTIEBOLAGET LM ERICSSON (publ) | Push of information from a server to a client |
US20010044818A1 (en) | 2000-02-21 | 2001-11-22 | Yufeng Liang | System and method for identifying and blocking pornogarphic and other web content on the internet |
GB2377308B (en) * | 2000-03-03 | 2004-03-17 | Dun And Bradstreet Inc | Facilitating a transaction in electronic commerce |
US7565403B2 (en) | 2000-03-16 | 2009-07-21 | Microsoft Corporation | Use of a bulk-email filter within a system for classifying messages for urgency or importance |
GB0006721D0 (en) | 2000-03-20 | 2000-05-10 | Mitchell Thomas A | Assessment methods and systems |
US20010032258A1 (en) | 2000-03-31 | 2001-10-18 | Kabushiki Kaisha Free Bit.Com | System for internet connections, system for providing internet user information, method for providing internet user preference information, and method for distributing digital contents using the internet |
US7418440B2 (en) | 2000-04-13 | 2008-08-26 | Ql2 Software, Inc. | Method and system for extraction and organizing selected data from sources on a network |
US6772214B1 (en) | 2000-04-27 | 2004-08-03 | Novell, Inc. | System and method for filtering of web-based content stored on a proxy cache server |
US20030158923A1 (en) | 2000-05-04 | 2003-08-21 | Reed Burkhart | System and method for automated negotiation for and allocation of a broadcast satellite, communication and caching system resource |
US7274667B2 (en) | 2000-05-19 | 2007-09-25 | Scientific-Atlanta, Inc. | Monitoring and allocating access across a shared communications medium |
US20040034794A1 (en) * | 2000-05-28 | 2004-02-19 | Yaron Mayer | System and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages |
US20040073617A1 (en) | 2000-06-19 | 2004-04-15 | Milliken Walter Clark | Hash-based systems and methods for detecting and preventing transmission of unwanted e-mail |
US6981281B1 (en) | 2000-06-21 | 2005-12-27 | Microsoft Corporation | Filtering a permission set using permission requests associated with a code assembly |
US6778986B1 (en) | 2000-07-31 | 2004-08-17 | Eliyon Technologies Corporation | Computer method and apparatus for determining site type of a web site |
US6785732B1 (en) | 2000-09-11 | 2004-08-31 | International Business Machines Corporation | Web server apparatus and method for virus checking |
US6886099B1 (en) | 2000-09-12 | 2005-04-26 | Networks Associates Technology, Inc. | Computer virus detection |
US6701317B1 (en) | 2000-09-19 | 2004-03-02 | Overture Services, Inc. | Web page connectivity server construction |
US6571249B1 (en) * | 2000-09-27 | 2003-05-27 | Siemens Aktiengesellschaft | Management of query result complexity in hierarchical query result data structure using balanced space cubes |
US20020073089A1 (en) | 2000-09-29 | 2002-06-13 | Andrew Schwartz | Method and system for creating and managing relational data over the internet |
JP2002175010A (en) | 2000-09-29 | 2002-06-21 | Shinu Ko | Home page falsification preventing system |
US6650890B1 (en) | 2000-09-29 | 2003-11-18 | Postini, Inc. | Value-added electronic messaging services and transparent implementation thereof using intermediate server |
US7072951B2 (en) * | 2000-10-03 | 2006-07-04 | Sun Microsystems, Inc. | HTTP transaction monitor with capacity to replay in debuggings session |
CA2323883C (en) | 2000-10-19 | 2016-02-16 | Patrick Ryan Morin | Method and device for classifying internet objects and objects stored oncomputer-readable media |
US20030177187A1 (en) | 2000-11-27 | 2003-09-18 | Butterfly.Net. Inc. | Computing grid for massively multi-player online games and other multi-user immersive persistent-state and session-based applications |
US6894991B2 (en) * | 2000-11-30 | 2005-05-17 | Verizon Laboratories Inc. | Integrated method for performing scheduling, routing and access control in a computer network |
US7209893B2 (en) * | 2000-11-30 | 2007-04-24 | Nokia Corporation | Method of and a system for distributing electronic content |
US6928051B2 (en) | 2000-12-18 | 2005-08-09 | Intel Corporation | Application based bandwidth limiting proxies |
US20030028564A1 (en) | 2000-12-19 | 2003-02-06 | Lingomotors, Inc. | Natural language method and system for matching and ranking documents in terms of semantic relatedness |
US7096493B1 (en) | 2000-12-21 | 2006-08-22 | Gary G. Liu | Internet file safety information center |
JP4329264B2 (en) | 2000-12-27 | 2009-09-09 | セイコーエプソン株式会社 | Access authority level control apparatus and method |
US6782388B2 (en) | 2000-12-29 | 2004-08-24 | Bellsouth Intellectual Property Corporation | Error usage investigation and disposal system |
US20020138621A1 (en) * | 2001-02-08 | 2002-09-26 | Rutherford Jan R. | System and method for displaying remotely stored content on a web page |
US7213069B2 (en) * | 2001-02-28 | 2007-05-01 | Microsoft Corporation | Category name service able to override the category name based on requestor privilege information |
US7363657B2 (en) | 2001-03-12 | 2008-04-22 | Emc Corporation | Using a virus checker in one file server to check for viruses in another file server |
US7681032B2 (en) | 2001-03-12 | 2010-03-16 | Portauthority Technologies Inc. | System and method for monitoring unauthorized transport of digital content |
US7058663B2 (en) | 2001-03-13 | 2006-06-06 | Koninklijke Philips Electronics, N.V. | Automatic data update |
US7219298B2 (en) * | 2001-03-15 | 2007-05-15 | International Business Machines Corporation | Method, system, and program for verifying network addresses included in a file |
KR100904572B1 (en) | 2001-03-29 | 2009-06-25 | 소니 가부시끼 가이샤 | Information processing apparatus |
US7114184B2 (en) | 2001-03-30 | 2006-09-26 | Computer Associates Think, Inc. | System and method for restoring computer systems damaged by a malicious computer program |
US6947935B1 (en) | 2001-04-04 | 2005-09-20 | Microsoft Corporation | Training, inference and user interface for guiding the caching of media content on local stores |
US20020152284A1 (en) | 2001-04-13 | 2002-10-17 | John Cambray | System and method for performing real time monitoring and control of an interactive network |
US7895445B1 (en) | 2001-04-26 | 2011-02-22 | Nokia Corporation | Token-based remote data access |
US7228565B2 (en) | 2001-05-15 | 2007-06-05 | Mcafee, Inc. | Event reporting between a reporting computer and a receiving computer |
US20030182420A1 (en) | 2001-05-21 | 2003-09-25 | Kent Jones | Method, system and apparatus for monitoring and controlling internet site content access |
US6898737B2 (en) * | 2001-05-24 | 2005-05-24 | Microsoft Corporation | Automatic classification of event data |
US7188368B2 (en) | 2001-05-25 | 2007-03-06 | Lenovo (Singapore) Pte. Ltd. | Method and apparatus for repairing damage to a computer system using a system rollback mechanism |
JP4598308B2 (en) | 2001-05-31 | 2010-12-15 | トレンドマイクロ株式会社 | Data communication system and data communication method |
US7289980B2 (en) | 2001-06-12 | 2007-10-30 | International Business Machines Corporation | Method and system for managing preferred web site links |
US6741997B1 (en) * | 2001-06-14 | 2004-05-25 | Oracle International Corporation | Instantiating objects in distributed database systems |
WO2003001413A1 (en) | 2001-06-22 | 2003-01-03 | Nosa Omoigui | System and method for knowledge retrieval, management, delivery and presentation |
US6934745B2 (en) * | 2001-06-28 | 2005-08-23 | Packeteer, Inc. | Methods, apparatuses and systems enabling a network services provider to deliver application performance management services |
US7310817B2 (en) | 2001-07-26 | 2007-12-18 | Mcafee, Inc. | Centrally managed malware scanning |
US7225430B2 (en) * | 2001-07-26 | 2007-05-29 | Landesk Software Limited | Software code management method and apparatus |
US7243369B2 (en) * | 2001-08-06 | 2007-07-10 | Sun Microsystems, Inc. | Uniform resource locator access management and control system and method |
JP3653242B2 (en) | 2001-08-06 | 2005-05-25 | デジタルア−ツ株式会社 | Method for managing access to the Internet, system thereof and computer program thereof |
US20060036874A1 (en) | 2001-08-08 | 2006-02-16 | Igt | Data pattern verification in a gaming machine environment |
ITMI20011757A1 (en) * | 2001-08-09 | 2003-02-09 | Nuovo Pignone Spa | MEANS OF CONNECTION BETWEEN ROD AND CROSS HEAD IN AN ALTERNATIVE COMPRESSOR |
US7370365B2 (en) * | 2001-09-05 | 2008-05-06 | International Business Machines Corporation | Dynamic control of authorization to access internet services |
US20040019656A1 (en) * | 2001-10-04 | 2004-01-29 | Smith Jeffrey C. | System and method for monitoring global network activity |
US7526654B2 (en) * | 2001-10-16 | 2009-04-28 | Marc Charbonneau | Method and system for detecting a secure state of a computer system |
US20030120543A1 (en) * | 2001-11-06 | 2003-06-26 | Carey Matthew S. | System, method, and product for use in supplying information via the internet |
US7680892B2 (en) * | 2001-11-06 | 2010-03-16 | Ihance, Inc. | Method and system for monitoring email and website behavior of an email recipient |
US6947985B2 (en) | 2001-12-05 | 2005-09-20 | Websense, Inc. | Filtering techniques for managing access to internet sites or other software applications |
US7194464B2 (en) | 2001-12-07 | 2007-03-20 | Websense, Inc. | System and method for adapting an internet filter |
US20030110272A1 (en) | 2001-12-11 | 2003-06-12 | Du Castel Bertrand | System and method for filtering content |
US7096500B2 (en) | 2001-12-21 | 2006-08-22 | Mcafee, Inc. | Predictive malware scanning of internet data |
US6944772B2 (en) | 2001-12-26 | 2005-09-13 | D'mitri Dozortsev | System and method of enforcing executable code identity verification over the network |
US20030126139A1 (en) | 2001-12-28 | 2003-07-03 | Lee Timothy A. | System and method for loading commercial web sites |
US20030135611A1 (en) | 2002-01-14 | 2003-07-17 | Dean Kemp | Self-monitoring service system with improved user administration and user access control |
US6792510B1 (en) | 2002-02-14 | 2004-09-14 | Novell, Inc. | System and method for updating a cache |
AU2002344640A1 (en) | 2002-02-15 | 2003-09-04 | Image Corporation | Application creation system, creation apparatus, creation method, application providing system, providing apparatus, providing method, application operation system, operation apparatus, and operation method |
US7089246B1 (en) | 2002-02-28 | 2006-08-08 | America Online, Inc. | Overriding content ratings and restricting access to requested resources |
US7870203B2 (en) | 2002-03-08 | 2011-01-11 | Mcafee, Inc. | Methods and systems for exposing messaging reputation to an end user |
US7903549B2 (en) | 2002-03-08 | 2011-03-08 | Secure Computing Corporation | Content-based policy compliance systems and methods |
US7512649B2 (en) | 2002-03-22 | 2009-03-31 | Sun Microsytems, Inc. | Distributed identities |
JP2004013258A (en) | 2002-06-04 | 2004-01-15 | Matsushita Electric Ind Co Ltd | Information filtering system |
US6993713B2 (en) | 2002-06-06 | 2006-01-31 | International Business Machines Corporation | Web content management software utilizing a workspace aware JSP servlet |
US20040006706A1 (en) | 2002-06-06 | 2004-01-08 | Ulfar Erlingsson | Methods and systems for implementing a secure application execution environment using derived user accounts for internet content |
CA2432594C (en) * | 2002-06-12 | 2011-01-11 | Telefonaktiebolaget Lm Ericsson (Publ) | Method and apparatus for increased internet protocol (ip) headers compression performance by reporting cause of missing packets |
US20040006621A1 (en) * | 2002-06-27 | 2004-01-08 | Bellinson Craig Adam | Content filtering for web browsing |
US7631318B2 (en) * | 2002-06-28 | 2009-12-08 | Microsoft Corporation | Secure server plug-in architecture for digital rights management systems |
US7568002B1 (en) | 2002-07-03 | 2009-07-28 | Sprint Spectrum L.P. | Method and system for embellishing web content during transmission between a content server and a client station |
US7203706B2 (en) | 2002-08-01 | 2007-04-10 | Oracle International Corporation | Buffered message queue architecture for database management systems with memory optimizations and “zero copy” buffered message queue |
US7159119B2 (en) | 2002-09-06 | 2007-01-02 | United States Postal Service | Method and system for efficiently retrieving secured data by securely pre-processing provided access information |
US20040049514A1 (en) * | 2002-09-11 | 2004-03-11 | Sergei Burkov | System and method of searching data utilizing automatic categorization |
FI113499B (en) | 2002-09-12 | 2004-04-30 | Jarmo Talvitie | A protection system, method and device for using computer viruses and isolating information |
JP4038717B2 (en) | 2002-09-13 | 2008-01-30 | 富士ゼロックス株式会社 | Text sentence comparison device |
US7203691B2 (en) * | 2002-09-27 | 2007-04-10 | Ncr Corp. | System and method for retrieving information from a database |
US20040068479A1 (en) * | 2002-10-04 | 2004-04-08 | International Business Machines Corporation | Exploiting asynchronous access to database operations |
US7437760B2 (en) | 2002-10-10 | 2008-10-14 | International Business Machines Corporation | Antiviral network system |
JP4217455B2 (en) * | 2002-10-15 | 2009-02-04 | キヤノン株式会社 | Peripheral device, information processing method, and control program |
US6850943B2 (en) * | 2002-10-18 | 2005-02-01 | Check Point Software Technologies, Inc. | Security system and methodology for providing indirect access control |
US7194531B2 (en) * | 2002-12-02 | 2007-03-20 | International Business Machines Corporation | System and method for determining the availability of a web page |
US7600234B2 (en) | 2002-12-10 | 2009-10-06 | Fisher-Rosemount Systems, Inc. | Method for launching applications |
EP1586054A4 (en) | 2002-12-13 | 2010-12-08 | Symantec Corp | Method, system, and computer program product for security within a global computer network |
US7171450B2 (en) | 2003-01-09 | 2007-01-30 | Microsoft Corporation | Framework to enable integration of anti-spam technologies |
US7533148B2 (en) | 2003-01-09 | 2009-05-12 | Microsoft Corporation | Framework to enable integration of anti-spam technologies |
FI20030104A0 (en) | 2003-01-23 | 2003-01-23 | Stonesoft Oyj | Detection and blocking of unknown compounds |
US20040153305A1 (en) | 2003-02-03 | 2004-08-05 | Enescu Mircea Gabriel | Method and system for automated matching of text based electronic messages |
US20040153644A1 (en) | 2003-02-05 | 2004-08-05 | Mccorkendale Bruce | Preventing execution of potentially malicious software |
US7206814B2 (en) | 2003-10-09 | 2007-04-17 | Propel Software Corporation | Method and system for categorizing and processing e-mails |
US7366761B2 (en) | 2003-10-09 | 2008-04-29 | Abaca Technology Corporation | Method for creating a whitelist for processing e-mails |
US7185015B2 (en) * | 2003-03-14 | 2007-02-27 | Websense, Inc. | System and method of monitoring and controlling application files |
US7529754B2 (en) | 2003-03-14 | 2009-05-05 | Websense, Inc. | System and method of monitoring and controlling application files |
US20060168006A1 (en) | 2003-03-24 | 2006-07-27 | Mr. Marvin Shannon | System and method for the classification of electronic communication |
US7739494B1 (en) | 2003-04-25 | 2010-06-15 | Symantec Corporation | SSL validation and stripping using trustworthiness factors |
GB2400931B (en) | 2003-04-25 | 2006-09-27 | Messagelabs Ltd | A method of, and system for, replacing external links in electronic documents |
US7272853B2 (en) | 2003-06-04 | 2007-09-18 | Microsoft Corporation | Origination/destination features and lists for spam prevention |
US8145710B2 (en) | 2003-06-18 | 2012-03-27 | Symantec Corporation | System and method for filtering spam messages utilizing URL filtering module |
US20050132042A1 (en) | 2003-07-07 | 2005-06-16 | Martin Cryer | HTTP protocol-based internet document rating system |
US20050015626A1 (en) | 2003-07-15 | 2005-01-20 | Chasin C. Scott | System and method for identifying and filtering junk e-mail messages or spam based on URL content |
JP4218451B2 (en) * | 2003-08-05 | 2009-02-04 | 株式会社日立製作所 | License management system, server device and terminal device |
US7444515B2 (en) | 2003-08-14 | 2008-10-28 | Washington University | Method and apparatus for detecting predefined signatures in packet payload using Bloom filters |
US20050044156A1 (en) | 2003-08-22 | 2005-02-24 | David Kaminski | Verified registry |
US7421498B2 (en) | 2003-08-25 | 2008-09-02 | Microsoft Corporation | Method and system for URL based filtering of electronic communications and web pages |
US20050058972A1 (en) | 2003-08-27 | 2005-03-17 | Mcdole Michael E. | Method for censorship |
US7376154B2 (en) * | 2003-08-29 | 2008-05-20 | Agilent Technologies, Inc. | Non-intrusive method for routing policy discovery |
US7587488B2 (en) | 2003-09-15 | 2009-09-08 | Blue Coat Systems, Inc. | Dynamic background rater for internet content |
US20050060140A1 (en) | 2003-09-15 | 2005-03-17 | Maddox Paul Christopher | Using semantic feature structures for document comparisons |
US7631181B2 (en) * | 2003-09-22 | 2009-12-08 | Canon Kabushiki Kaisha | Communication apparatus and method, and program for applying security policy |
US7610342B1 (en) | 2003-10-21 | 2009-10-27 | Microsoft Corporation | System and method for analyzing and managing spam e-mail |
US20050091535A1 (en) * | 2003-10-24 | 2005-04-28 | Microsoft Corporation | Application identity for software products |
US7373385B2 (en) | 2003-11-03 | 2008-05-13 | Cloudmark, Inc. | Method and apparatus to block spam based on spam reports from a community of users |
US7219299B2 (en) | 2003-11-19 | 2007-05-15 | Microsoft Corporation | Method for blocking dereferencing elements in messages |
US7797443B1 (en) | 2003-12-03 | 2010-09-14 | Microsoft Corporation | System and method for detecting spam e-mail |
CA2452269A1 (en) | 2003-12-03 | 2005-06-03 | Jin Li | Method and system for standard bookmark classification of web sites |
US7082429B2 (en) | 2003-12-10 | 2006-07-25 | National Chiao Tung University | Method for web content filtering |
US7398399B2 (en) | 2003-12-12 | 2008-07-08 | International Business Machines Corporation | Apparatus, methods and computer programs for controlling performance of operations within a data processing system or network |
US8301702B2 (en) | 2004-01-20 | 2012-10-30 | Cloudmark, Inc. | Method and an apparatus to screen electronic communications |
JP2005208780A (en) * | 2004-01-21 | 2005-08-04 | Nec Corp | Mail filtering system and url black list dynamic construction method to be used for the same |
US7647383B1 (en) | 2004-03-11 | 2010-01-12 | Microsoft Corporation | Intelligent message deletion |
US7966658B2 (en) | 2004-04-08 | 2011-06-21 | The Regents Of The University Of California | Detecting public network attacks using signatures and fast content analysis |
US20050235036A1 (en) * | 2004-04-19 | 2005-10-20 | Nielsen Jim R | Intelligent URL redirector |
US20050262063A1 (en) * | 2004-04-26 | 2005-11-24 | Watchfire Corporation | Method and system for website analysis |
US7627670B2 (en) | 2004-04-29 | 2009-12-01 | International Business Machines Corporation | Method and apparatus for scoring unsolicited e-mail |
US7457823B2 (en) | 2004-05-02 | 2008-11-25 | Markmonitor Inc. | Methods and systems for analyzing data related to possible online fraud |
US7870608B2 (en) * | 2004-05-02 | 2011-01-11 | Markmonitor, Inc. | Early detection and monitoring of online fraud |
US20070299915A1 (en) | 2004-05-02 | 2007-12-27 | Markmonitor, Inc. | Customer-based detection of online fraud |
US8769671B2 (en) | 2004-05-02 | 2014-07-01 | Markmonitor Inc. | Online fraud solution |
US7992204B2 (en) * | 2004-05-02 | 2011-08-02 | Markmonitor, Inc. | Enhanced responses to online fraud |
US6984991B2 (en) * | 2004-05-11 | 2006-01-10 | International Business Machines Corporation | Initialization of a bidirectional, self-timed parallel interface with automatic testing of AC differential wire pairs |
US7941490B1 (en) | 2004-05-11 | 2011-05-10 | Symantec Corporation | Method and apparatus for detecting spam in email messages and email attachments |
US7818377B2 (en) | 2004-05-24 | 2010-10-19 | Microsoft Corporation | Extended message rule architecture |
US7668951B2 (en) | 2004-05-25 | 2010-02-23 | Google Inc. | Electronic message source reputation information system |
US7756930B2 (en) | 2004-05-28 | 2010-07-13 | Ironport Systems, Inc. | Techniques for determining the reputation of a message sender |
US7870200B2 (en) | 2004-05-29 | 2011-01-11 | Ironport Systems, Inc. | Monitoring the flow of messages received at a server |
US7849142B2 (en) | 2004-05-29 | 2010-12-07 | Ironport Systems, Inc. | Managing connections, messages, and directory harvest attacks at a server |
US7941491B2 (en) | 2004-06-04 | 2011-05-10 | Messagemind, Inc. | System and method for dynamic adaptive user-based prioritization and display of electronic messages |
US7748038B2 (en) | 2004-06-16 | 2010-06-29 | Ironport Systems, Inc. | Method and apparatus for managing computer virus outbreaks |
US7971245B2 (en) | 2004-06-21 | 2011-06-28 | Ebay Inc. | Method and system to detect externally-referenced malicious data for access and/or publication via a computer system |
US7664819B2 (en) | 2004-06-29 | 2010-02-16 | Microsoft Corporation | Incremental anti-spam lookup and update service |
US7693945B1 (en) | 2004-06-30 | 2010-04-06 | Google Inc. | System for reclassification of electronic messages in a spam filtering system |
US7428530B2 (en) * | 2004-07-01 | 2008-09-23 | Microsoft Corporation | Dispersing search engine results by using page category information |
US20060036966A1 (en) * | 2004-08-10 | 2006-02-16 | Slava Yevdayev | Method and system for presenting links associated with a requested website |
WO2006027590A1 (en) | 2004-09-09 | 2006-03-16 | Surfcontrol Plc | System, method and apparatus for use in monitoring or controlling internet access |
GB2418037B (en) * | 2004-09-09 | 2007-02-28 | Surfcontrol Plc | System, method and apparatus for use in monitoring or controlling internet access |
GB2418999A (en) | 2004-09-09 | 2006-04-12 | Surfcontrol Plc | Categorizing uniform resource locators |
WO2006036170A1 (en) | 2004-09-15 | 2006-04-06 | Pcsafe, Inc. | Methods and systems for filtering urls, webpages, and content |
GB0420548D0 (en) * | 2004-09-15 | 2004-10-20 | Streamshield Networks Ltd | Network-based security platform |
GB2418330B (en) | 2004-09-17 | 2006-11-08 | Jeroen Oostendorp | Platform for intelligent Email distribution |
US20060064469A1 (en) | 2004-09-23 | 2006-03-23 | Cisco Technology, Inc. | System and method for URL filtering in a firewall |
US8037527B2 (en) * | 2004-11-08 | 2011-10-11 | Bt Web Solutions, Llc | Method and apparatus for look-ahead security scanning |
US7454778B2 (en) | 2004-09-30 | 2008-11-18 | Microsoft Corporation | Enforcing rights management through edge email servers |
US8117339B2 (en) * | 2004-10-29 | 2012-02-14 | Go Daddy Operating Company, LLC | Tracking domain name related reputation |
US7716727B2 (en) * | 2004-10-29 | 2010-05-11 | Microsoft Corporation | Network security device and method for protecting a computing device in a networked environment |
US20060095459A1 (en) * | 2004-10-29 | 2006-05-04 | Warren Adelman | Publishing domain name related reputation in whois records |
US20060095404A1 (en) * | 2004-10-29 | 2006-05-04 | The Go Daddy Group, Inc | Presenting search engine results based on domain name related reputation |
US7574409B2 (en) | 2004-11-04 | 2009-08-11 | Vericept Corporation | Method, apparatus, and system for clustering and classification |
US8635690B2 (en) | 2004-11-05 | 2014-01-21 | Mcafee, Inc. | Reputation based message processing |
US8010685B2 (en) | 2004-11-09 | 2011-08-30 | Cisco Technology, Inc. | Method and apparatus for content classification |
US20060122957A1 (en) | 2004-12-03 | 2006-06-08 | Johnny Chen | Method and system to detect e-mail spam using concept categorization of linked content |
WO2006062546A2 (en) | 2004-12-07 | 2006-06-15 | Ayman, Llc | System and method of filtering electronic messages |
US7519818B2 (en) | 2004-12-09 | 2009-04-14 | Microsoft Corporation | Method and system for processing a communication based on trust that the communication is not unwanted as assigned by a sending domain |
US7580982B2 (en) | 2004-12-14 | 2009-08-25 | The Go Daddy Group, Inc. | Email filtering system and method |
US20060184655A1 (en) * | 2004-12-30 | 2006-08-17 | Brandon Shalton | Traffic analysis |
US7899866B1 (en) | 2004-12-31 | 2011-03-01 | Microsoft Corporation | Using message features and sender identity for email spam filtering |
US7487217B2 (en) | 2005-02-04 | 2009-02-03 | Microsoft Corporation | Network domain reputation-based spam filtering |
US7831834B2 (en) | 2005-03-14 | 2010-11-09 | Yahoo! Inc | Associating a postmark with a message to indicate trust |
US7562304B2 (en) | 2005-05-03 | 2009-07-14 | Mcafee, Inc. | Indicating website reputations during website manipulation of user information |
WO2006119509A2 (en) | 2005-05-05 | 2006-11-09 | Ironport Systems, Inc. | Identifying threats in electronic messages |
US20060259948A1 (en) | 2005-05-12 | 2006-11-16 | International Business Machines Corporation | Integrated document handling in distributed collaborative applications |
US7548922B2 (en) | 2005-05-17 | 2009-06-16 | International Business Machines Corporation | Customized and consolidated bookmarks |
US7788723B2 (en) | 2005-05-17 | 2010-08-31 | Computer Associates Think, Inc. | Method and apparatus for identifying computer vulnerabilities using exploit probes and remote scanning |
US7937480B2 (en) | 2005-06-02 | 2011-05-03 | Mcafee, Inc. | Aggregation of reputation data |
GB2426887B (en) | 2005-06-04 | 2009-01-07 | Ibm | Client responsibilities in messaging systems |
US8010609B2 (en) | 2005-06-20 | 2011-08-30 | Symantec Corporation | Method and apparatus for maintaining reputation lists of IP addresses to detect email spam |
US7660861B2 (en) | 2005-06-21 | 2010-02-09 | Data Laboratory, L.L.C. | System and method for verifying the identity of a sender of electronic mail and preventing unsolicited bulk email |
US7739338B2 (en) | 2005-06-21 | 2010-06-15 | Data Laboratory, L.L.C. | System and method for encoding and verifying the identity of a sender of electronic mail and preventing unsolicited bulk email |
US20070011739A1 (en) * | 2005-06-28 | 2007-01-11 | Shay Zamir | Method for increasing the security level of a user machine browsing web pages |
US20070028302A1 (en) * | 2005-07-29 | 2007-02-01 | Bit 9, Inc. | Distributed meta-information query in a network |
US7516184B2 (en) * | 2005-11-22 | 2009-04-07 | Cisco Technology, Inc. | Method and system for a method for evaluating a message based in part on a registrar reputation |
US8938515B2 (en) | 2005-12-29 | 2015-01-20 | Sap Se | Master queue for messaging service |
US20070204223A1 (en) | 2006-02-27 | 2007-08-30 | Jay Bartels | Methods of and systems for personalizing and publishing online content |
US7636703B2 (en) | 2006-05-02 | 2009-12-22 | Exegy Incorporated | Method and apparatus for approximate pattern matching |
US20080016339A1 (en) * | 2006-06-29 | 2008-01-17 | Jayant Shukla | Application Sandbox to Detect, Remove, and Prevent Malware |
US8615800B2 (en) | 2006-07-10 | 2013-12-24 | Websense, Inc. | System and method for analyzing web content |
US20080077517A1 (en) | 2006-09-22 | 2008-03-27 | Robert Grove Sappington | Reputation, Information & Communication Management |
US20080086372A1 (en) | 2006-10-10 | 2008-04-10 | Anand Madhavan | Contextual banner advertising |
US20080267144A1 (en) | 2007-04-26 | 2008-10-30 | Motorola, Inc. | System and method for managing broadcast and/or multicast based communication sessions for mobile nodes |
-
2006
- 2006-07-10 US US11/484,240 patent/US8020206B2/en active Active
-
2007
- 2007-07-09 CN CN200780025938.7A patent/CN101517570B/en active Active
- 2007-07-09 CA CA002656571A patent/CA2656571A1/en not_active Abandoned
- 2007-07-09 EP EP07835950A patent/EP2044539A2/en not_active Withdrawn
- 2007-07-09 WO PCT/US2007/015280 patent/WO2008008219A2/en active Application Filing
- 2007-07-09 AU AU2007273085A patent/AU2007273085B2/en not_active Expired - Fee Related
-
2011
- 2011-06-20 US US13/164,688 patent/US8978140B2/en active Active
-
2015
- 2015-03-09 US US14/642,561 patent/US9723018B2/en active Active
Patent Citations (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
USRE41168E1 (en) * | 1998-03-31 | 2010-03-23 | Content Advisor, Inc. | Controlling client access to networked data based on content subject matter categorization |
US6839680B1 (en) * | 1999-09-30 | 2005-01-04 | Fujitsu Limited | Internet profiling |
US20040128285A1 (en) * | 2000-12-15 | 2004-07-01 | Jacob Green | Dynamic-content web crawling through traffic monitoring |
US20030009495A1 (en) * | 2001-06-29 | 2003-01-09 | Akli Adjaoute | Systems and methods for filtering electronic content |
US20040172389A1 (en) * | 2001-07-27 | 2004-09-02 | Yaron Galai | System and method for automated tracking and analysis of document usage |
US20110314546A1 (en) * | 2004-04-01 | 2011-12-22 | Ashar Aziz | Electronic Message Analysis for Malware Detection |
US20070294352A1 (en) * | 2004-05-02 | 2007-12-20 | Markmonitor, Inc. | Generating phish messages |
US20060075494A1 (en) * | 2004-10-01 | 2006-04-06 | Bertman Justin R | Method and system for analyzing data for potential malware |
US20060075500A1 (en) * | 2004-10-01 | 2006-04-06 | Bertman Justin R | System and method for locating malware |
US20090138573A1 (en) * | 2005-04-22 | 2009-05-28 | Alexander Wade Campbell | Methods and apparatus for blocking unwanted software downloads |
US8015250B2 (en) * | 2005-06-22 | 2011-09-06 | Websense Hosted R&D Limited | Method and system for filtering electronic messages |
US20080082662A1 (en) * | 2006-05-19 | 2008-04-03 | Richard Dandliker | Method and apparatus for controlling access to network resources based on reputation |
Non-Patent Citations (2)
Title |
---|
Cooley et al, Web Mining: Information and Pattern Discovery on the World Wide Web, 1997, IEEE, pgs. 558-567. * |
Lee et al, Neural Networks for Web Content Filtering, September 2002, IEEE, pgs. 48-57. * |
Cited By (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8479284B1 (en) | 2007-12-20 | 2013-07-02 | Symantec Corporation | Referrer context identification for remote object links |
US8180761B1 (en) * | 2007-12-27 | 2012-05-15 | Symantec Corporation | Referrer context aware target queue prioritization |
US20110191455A1 (en) * | 2010-02-02 | 2011-08-04 | Patrick Gardner | Using Aggregated DNS Information Originating from Multiple Sources to Detect Anomalous DNS Name Resolutions |
US8321551B2 (en) * | 2010-02-02 | 2012-11-27 | Symantec Corporation | Using aggregated DNS information originating from multiple sources to detect anomalous DNS name resolutions |
US20130227640A1 (en) * | 2010-09-09 | 2013-08-29 | NSFOCUS Information Technology Co., Ltd. | Method and apparatus for website scanning |
US10491618B2 (en) * | 2010-09-09 | 2019-11-26 | NSFOCUS Information Technology Co., Ltd. | Method and apparatus for website scanning |
US20120167220A1 (en) * | 2010-12-23 | 2012-06-28 | Korea Internet & Security Agency | Seed information collecting device and method for detecting malicious code landing/hopping/distribution sites |
US9047456B2 (en) | 2012-03-20 | 2015-06-02 | Canon Information And Imaging Solutions, Inc. | System and method for controlling access to a resource |
WO2013162264A1 (en) * | 2012-04-23 | 2013-10-31 | 줌인터넷 주식회사 | Method and system for collecting objects by using packet mirroring |
WO2013184653A1 (en) * | 2012-06-04 | 2013-12-12 | Board Of Regents, The University Of Texas System | Method and system for resilient and adaptive detection of malicious websites |
US20150120692A1 (en) * | 2012-06-30 | 2015-04-30 | Huawei Technologies Co., Ltd. | Method, device, and system for acquiring user behavior |
US20150222660A1 (en) * | 2012-10-18 | 2015-08-06 | Tencent Technology (Shenzhen) Company Limited | Method and apparatus for detecting hidden content of web page |
US9979746B2 (en) * | 2012-10-18 | 2018-05-22 | Tencent Technology (Shenzhen) Company Limited | Method and apparatus for detecting hidden content of web page |
US10333972B2 (en) | 2012-10-18 | 2019-06-25 | Tencent Technology (Shenzhen) Company Limited | Method and apparatus for detecting hidden content of web page |
US10334015B2 (en) * | 2017-04-28 | 2019-06-25 | Bank Of America Corporation | Apparatus and methods for shortening user exposure to malicious websites |
Also Published As
Publication number | Publication date |
---|---|
WO2008008219A3 (en) | 2008-02-28 |
AU2007273085B2 (en) | 2012-07-12 |
CA2656571A1 (en) | 2008-01-17 |
US9723018B2 (en) | 2017-08-01 |
US20150180899A1 (en) | 2015-06-25 |
CN101517570B (en) | 2015-09-16 |
AU2007273085A1 (en) | 2008-01-17 |
US8978140B2 (en) | 2015-03-10 |
CN101517570A (en) | 2009-08-26 |
US20080010368A1 (en) | 2008-01-10 |
EP2044539A2 (en) | 2009-04-08 |
WO2008008219A2 (en) | 2008-01-17 |
US8020206B2 (en) | 2011-09-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9723018B2 (en) | System and method of analyzing web content | |
US9680866B2 (en) | System and method for analyzing web content | |
US9654495B2 (en) | System and method of analyzing web addresses | |
AU2008219550B2 (en) | System and method of blocking malicios web content | |
Canali et al. | Prophiler: a fast filter for the large-scale detection of malicious web pages | |
US8359651B1 (en) | Discovering malicious locations in a public computer network | |
US20060075468A1 (en) | System and method for locating malware and generating malware definitions | |
US20060075490A1 (en) | System and method for actively operating malware to generate a definition | |
AU2013206427A1 (en) | System and method of analyzing web addresses | |
McKenna | Detection and classification of Web robots with honeypots | |
Boyapati et al. | Anti-phishing approaches in the era of the internet of things | |
Tischler | Automated Web Mining of User Information |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: JPMORGAN CHASE BANK, N.A., DELAWARE Free format text: FIRST LIEN SECURITY AGREEMENT;ASSIGNORS:WEBSENSE, INC.;PORTAUTHORITY TECHNOLOGIES, INC.;REEL/FRAME:030694/0615 Effective date: 20130625 |
|
AS | Assignment |
Owner name: ROYAL BANK OF CANADA, CANADA Free format text: SECOND LIEN SECURITY AGREEMENT;ASSIGNORS:WEBSENSE, INC.;PORTAUTHORITY TECHNOLOGIES, INC.;REEL/FRAME:030704/0374 Effective date: 20130625 |
|
AS | Assignment |
Owner name: ROYAL BANK OF CANADA, AS SUCCESSOR COLLATERAL AGEN Free format text: ASSIGNMENT OF SECURITY INTEREST;ASSIGNOR:JPMORGAN CHASE BANK, N.A., AS EXISTING COLLATERAL AGENT;REEL/FRAME:032716/0916 Effective date: 20140408 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
AS | Assignment |
Owner name: PORT AUTHORITY TECHNOLOGIES, INC., CALIFORNIA Free format text: RELEASE OF SECOND LIEN SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME: 30704/0374;ASSIGNOR:ROYAL BANK OF CANADA, AS COLLATERAL AGENT;REEL/FRAME:035801/0689 Effective date: 20150529 Owner name: WEBSENSE, INC., TEXAS Free format text: RELEASE OF SECOND LIEN SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME: 30704/0374;ASSIGNOR:ROYAL BANK OF CANADA, AS COLLATERAL AGENT;REEL/FRAME:035801/0689 Effective date: 20150529 Owner name: PORT AUTHORITY TECHNOLOGIES, INC., CALIFORNIA Free format text: RELEASE OF FIRST LIEN SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME: 030694/0615;ASSIGNOR:ROYAL BANK OF CANADA, AS COLLATERAL AGENT;REEL/FRAME:035858/0680 Effective date: 20150529 Owner name: WEBSENSE, INC., TEXAS Free format text: RELEASE OF FIRST LIEN SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME: 030694/0615;ASSIGNOR:ROYAL BANK OF CANADA, AS COLLATERAL AGENT;REEL/FRAME:035858/0680 Effective date: 20150529 |
|
AS | Assignment |
Owner name: RAYTHEON COMPANY, MASSACHUSETTS Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:WEBSENSE, INC.;RAYTHEON OAKLEY SYSTEMS, LLC;RAYTHEON CYBER PRODUCTS, LLC (FORMERLY KNOWN AS RAYTHEON CYBER PRODUCTS, INC.);AND OTHERS;REEL/FRAME:035859/0282 Effective date: 20150529 |
|
AS | Assignment |
Owner name: WEBSENSE, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HUBBARD, DAN;VERENINI, NICHOLAS JOSEPH;BADDOUR, VICTOR LOUIE;REEL/FRAME:037265/0274 Effective date: 20060922 |
|
AS | Assignment |
Owner name: WEBSENSE LLC, TEXAS Free format text: CHANGE OF NAME;ASSIGNOR:WEBSENSE, INC.;REEL/FRAME:039590/0646 Effective date: 20151230 |
|
AS | Assignment |
Owner name: WEBSENSE, LLC, TEXAS Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE FROM WEBSENSE LLC TO WEBSENSE, LLC PREVIOUSLY RECORDED ON REEL 039590 FRAME 0646. ASSIGNOR(S) HEREBY CONFIRMS THE CHANGE OF NAME;ASSIGNOR:WEBSENSE, INC.;REEL/FRAME:039951/0904 Effective date: 20151230 |
|
AS | Assignment |
Owner name: FORCEPOINT LLC, TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WEBSENSE, LLC;REEL/FRAME:043397/0440 Effective date: 20170728 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |
|
AS | Assignment |
Owner name: WEBSENSE, INC., TEXAS Free format text: RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:RAYTHEON COMPANY;REEL/FRAME:055492/0146 Effective date: 20210108 Owner name: RAYTHEON OAKLEY SYSTEMS, LLC, TEXAS Free format text: RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:RAYTHEON COMPANY;REEL/FRAME:055492/0146 Effective date: 20210108 Owner name: PORTAUTHORITY TECHNOLOGIES, LLC (FKA PORTAUTHORITY TECHNOLOGIES, INC.), TEXAS Free format text: RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:RAYTHEON COMPANY;REEL/FRAME:055492/0146 Effective date: 20210108 Owner name: FORCEPOINT FEDERAL LLC (FKA RAYTHEON CYBER PRODUCTS, LLC, FKA RAYTHEON CYBER PRODUCTS, INC.), TEXAS Free format text: RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:RAYTHEON COMPANY;REEL/FRAME:055492/0146 Effective date: 20210108 |
|
AS | Assignment |
Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT, NEW YORK Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:REDOWL ANALYTICS, INC.;FORCEPOINT LLC;REEL/FRAME:055052/0302 Effective date: 20210108 |
|
AS | Assignment |
Owner name: FORCEPOINT FEDERAL HOLDINGS LLC, TEXAS Free format text: CHANGE OF NAME;ASSIGNOR:FORCEPOINT LLC;REEL/FRAME:056183/0265 Effective date: 20210401 |
|
AS | Assignment |
Owner name: FORCEPOINT LLC, TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:FORCEPOINT FEDERAL HOLDINGS LLC;REEL/FRAME:056272/0475 Effective date: 20210401 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |